Red Hat Product Security issued an advisory for Apache Tomcat vulnerabilities affecting Red Hat Enterprise Linux 9. The first vulnerability (CVE-2026-29146) is an information disclosure issue caused by a Padding Oracle vulnerability in the EncryptInterceptor component. The second vulnerability (CVE-2026-34486) involves missing encryption of sensitive data due to a bypass of the EncryptInterceptor. Both vulnerabilities could lead to unauthorized disclosure of sensitive information. Red Hat has released updated Tomcat packages (version 9.0.117-2.el9_8) that fix these issues. The advisory also notes removal of the tomcat clustering JAR from RPM builds as a bug fix and enhancement. The update is rated as Important by Red Hat and applies to multiple architectures and extended support versions of Red Hat Enterprise Linux 9.

Successful exploitation of CVE-2026-29146 could allow an attacker to gain unauthorized access to sensitive information through a Padding Oracle attack on the EncryptInterceptor. CVE-2026-34486 could result in sensitive data not being encrypted properly due to bypassing the EncryptInterceptor, increasing the risk of data exposure. These vulnerabilities affect the confidentiality of data processed by Apache Tomcat on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released updated Apache Tomcat packages that address these vulnerabilities. Users should apply the security update described in Red Hat Advisory RHSA-2026:36879 promptly. The update is available for Red Hat Enterprise Linux 9 and its extended support variants. Refer to the Red Hat article https://access.redhat.com/articles/11258 for detailed instructions on applying the update. No additional mitigation steps are indicated by the vendor advisory.