CVE-2026-34486

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34486
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34486.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34486
Aliases
Downstream
CGA (5)
CLSA (11)
MGASA (1)
OESA (1)
openSUSE (6)
RHSA (12)
RLSA (4)
ROOT (1)
SUSE (7)
UBUNTU (1)
Related
ALSA (4)
openSUSE (6)
SUSE (7)
Published
2026-04-09T19:35:35Z
Modified
2026-09-23T03:30:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Details

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-311"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34486.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "11.0.20"
                },
                {
                    "last_affected":  "11.0.20"
                },
                {
                    "introduced":  "10.1.53"
                },
                {
                    "last_affected":  "10.1.53"
                },
                {
                    "introduced":  "9.0.116"
                },
                {
                    "last_affected":  "9.0.116"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
Last Affected
1c65de6f27a3bac481514e56e3637785b65a4f2c
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "9.0.116"
        },
        {
            "last_affected":  "9.0.116"
        },
        {
            "introduced":  "10.1.53"
        },
        {
            "last_affected":  "10.1.53"
        },
        {
            "introduced":  "11.0.20"
        },
        {
            "last_affected":  "11.0.20"
        }
    ],
    "source":  "CPE_STRING"
}

Affected versions

10.*
10.1.53
11.*
11.0.20
9.*
9.0.116

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34486.json"