Tomcat8: Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
A Padding Oracle vulnerability exists in Apache Tomcat's EncryptInterceptor when using the default configuration. This affects multiple versions of Apache Tomcat across major branches including 7.0.x, 8.5.x, 9.0.x, 10.0.x, 10.1.x, and 11.0.x. The vulnerability allows an attacker to gain information about encrypted data through padding oracle attacks. Fixed versions have been released to address this issue.
AI Analysis
Technical Summary
The vulnerability is a Padding Oracle issue in Apache Tomcat's EncryptInterceptor component under default configuration. It affects Apache Tomcat versions from 7.0.100 through 7.0.109, 8.5.38 through 8.5.100, 9.0.13 through 9.0.115, 10.0.0-M1 through 10.1.52, and 11.0.0-M1 through 11.0.18. The vulnerability allows attackers to exploit padding oracle attacks to potentially decrypt sensitive data. The issue is resolved in Apache Tomcat versions 11.0.19, 10.1.53, and 9.0.116 and later.
Potential Impact
Successful exploitation of this vulnerability could allow an unauthenticated attacker to decrypt encrypted data by exploiting the padding oracle flaw in the EncryptInterceptor. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. This means the attacker can remotely gain access to sensitive encrypted information without authentication.
Mitigation Recommendations
Users are strongly advised to upgrade affected Apache Tomcat installations to versions 11.0.19, 10.1.53, or 9.0.116 or later, where the vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is confirmed as official fixes are available in these versions.
Tomcat8: Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
Description
A Padding Oracle vulnerability exists in Apache Tomcat's EncryptInterceptor when using the default configuration. This affects multiple versions of Apache Tomcat across major branches including 7.0.x, 8.5.x, 9.0.x, 10.0.x, 10.1.x, and 11.0.x. The vulnerability allows an attacker to gain information about encrypted data through padding oracle attacks. Fixed versions have been released to address this issue.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/[email protected]~18.04.3+esm6?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/[email protected]+esm8?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/[email protected]+esm4?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/[email protected]~esm4?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/[email protected]?arch=source&distro=questingpkg:deb/ubuntu/[email protected]?arch=source&distro=questingpkg:deb/ubuntu/[email protected]~26.04.1?arch=source&distro=resolutepkg:deb/ubuntu/[email protected]~26.04.1?arch=source&distro=resolutepkg:deb/ubuntu/[email protected]~26.04.1?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability is a Padding Oracle issue in Apache Tomcat's EncryptInterceptor component under default configuration. It affects Apache Tomcat versions from 7.0.100 through 7.0.109, 8.5.38 through 8.5.100, 9.0.13 through 9.0.115, 10.0.0-M1 through 10.1.52, and 11.0.0-M1 through 11.0.18. The vulnerability allows attackers to exploit padding oracle attacks to potentially decrypt sensitive data. The issue is resolved in Apache Tomcat versions 11.0.19, 10.1.53, and 9.0.116 and later.
Potential Impact
Successful exploitation of this vulnerability could allow an unauthenticated attacker to decrypt encrypted data by exploiting the padding oracle flaw in the EncryptInterceptor. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. This means the attacker can remotely gain access to sensitive encrypted information without authentication.
Mitigation Recommendations
Users are strongly advised to upgrade affected Apache Tomcat installations to versions 11.0.19, 10.1.53, or 9.0.116 or later, where the vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is confirmed as official fixes are available in these versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-29146
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b4d868715ace43dabc09
Added to database: 07/16/2026, 10:39:20 UTC
Last enriched: 07/30/2026, 11:21:37 UTC
Last updated: 07/31/2026, 19:24:46 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.