This advisory covers two vulnerabilities in Apache Tomcat related to the EncryptInterceptor component. CVE-2026-29146 is an information disclosure vulnerability exploitable via a Padding Oracle attack, potentially allowing attackers to gain unauthorized information. CVE-2026-34486 involves a bypass of the EncryptInterceptor that results in missing encryption of sensitive data, weakening data protection. Red Hat has issued security updates for Red Hat Enterprise Linux 9.6 Extended Update Support to address these issues. The advisory references updated Tomcat packages version 9.0.87-4.el9_6 and related components. No CVSS score is provided in the advisory, but the severity is rated as Important by Red Hat.

Successful exploitation of CVE-2026-29146 could lead to unauthorized disclosure of sensitive information due to a Padding Oracle vulnerability in the EncryptInterceptor. CVE-2026-34486 could allow sensitive data to be transmitted or stored without proper encryption due to an EncryptInterceptor bypass. Both vulnerabilities weaken the confidentiality guarantees of applications using the affected Tomcat versions. There are no known exploits in the wild at the time of the advisory. The overall security impact is rated as Important by Red Hat.

Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:36877 and the referenced article https://access.redhat.com/articles/11258. Applying the official update fully mitigates these issues. No additional mitigation steps are indicated by the vendor advisory.