Configured cipher preference order not preserved vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/09/22 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Apr 2026, 14:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/09/22 - Mailing List, Third Party Advisory | |
| First Time |
Apache
Apache tomcat |
|
| CPE | cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* |
10 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-327 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
10 Apr 2026, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-09 20:16
Updated : 2026-04-14 14:00
NVD link : CVE-2026-29129
Mitre link : CVE-2026-29129
CVE.ORG link : CVE-2026-29129
JSON object : View
Products Affected
apache
- tomcat
CWE
CWE-327
Use of a Broken or Risky Cryptographic Algorithm