GHSA-69cc-cv78-qc8g

Suggest an improvement
Source
https://github.com/advisories/GHSA-69cc-cv78-qc8g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-69cc-cv78-qc8g
Aliases
  • CVE-2026-29129
Related
Published
2026-04-09T21:31:29Z
Modified
2026-04-11T16:29:35.867201290Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Tomcat: Configured cipher preference order not preserved
Details

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Database specific 
{
    "nvd_published_at": "2026-04-09T20:16:24Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-327"
    ],
    "github_reviewed_at": "2026-04-10T22:07:11Z"
}
References

Affected packages

Maven
org.apache.tomcat:tomcat-catalina

Package

Name
org.apache.tomcat:tomcat-catalina
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-catalina

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.0.114
Fixed
9.0.116

Affected versions

9.*
9.0.115

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat:tomcat-catalina

Package

Name
org.apache.tomcat:tomcat-catalina
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-catalina

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.1.51
Fixed
10.1.53

Affected versions

10.*
10.1.52

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat:tomcat-catalina

Package

Name
org.apache.tomcat:tomcat-catalina
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-catalina

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.16
Fixed
11.0.20

Affected versions

11.*
11.0.18

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.0.114
Fixed
9.0.116

Affected versions

9.*
9.0.115

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.1.51
Fixed
10.1.53

Affected versions

10.*
10.1.52

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.16
Fixed
11.0.20

Affected versions

11.*
11.0.18

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat.embed:tomcat-embed-core

Package

Name
org.apache.tomcat.embed:tomcat-embed-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat.embed/tomcat-embed-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.0.114
Fixed
9.0.116

Affected versions

9.*
9.0.115

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat.embed:tomcat-embed-core

Package

Name
org.apache.tomcat.embed:tomcat-embed-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat.embed/tomcat-embed-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.1.51
Fixed
10.1.53

Affected versions

10.*
10.1.52

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"
org.apache.tomcat.embed:tomcat-embed-core

Package

Name
org.apache.tomcat.embed:tomcat-embed-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat.embed/tomcat-embed-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.16
Fixed
11.0.20

Affected versions

11.*
11.0.18

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69cc-cv78-qc8g/GHSA-69cc-cv78-qc8g.json"