Red Hat released security updates for Apache Tomcat addressing several vulnerabilities, including CVE-2026-29146 (information disclosure via Padding Oracle vulnerability in EncryptInterceptor) and CVE-2026-34486 (missing encryption of sensitive data due to EncryptInterceptor bypass). These vulnerabilities could lead to unauthorized information disclosure and bypass of encryption protections. The advisory also covers fixes for additional vulnerabilities affecting authentication, authorization, HTTP/2 header validation, denial of service, and timing discrepancies in Tomcat components. The updates are included in Red Hat JBoss Web Server 7.0.0 and Red Hat Enterprise Linux 10.0 Extended Update Support packages.

The vulnerabilities fixed could allow attackers to gain unauthorized access to sensitive information through information disclosure and bypass encryption protections. Other issues fixed include authentication bypass, improper authorization allowing security constraint bypass, denial of service via resource exhaustion, and exposure of HTTP authentication headers during WebSocket authentication. These issues collectively pose a high security risk by potentially compromising confidentiality, integrity, and availability of applications running on affected Tomcat versions.

Red Hat has released official security updates addressing these vulnerabilities in Apache Tomcat as part of Red Hat JBoss Web Server 7.0.0 and Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply these updates promptly. Detailed instructions for applying the updates are available at https://access.redhat.com/articles/11258. Ensure all previously released errata relevant to your system are applied before updating. No additional mitigation steps are required beyond applying the official patches.