CVE-2026-34486

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34486
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*
History

14 Apr 2026, 12:45

Type Values Removed Values Added
First Time Apache
Apache tomcat
References () https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly - () https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly - Mailing List, Vendor Advisory
CPE cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*

10 Apr 2026, 21:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

09 Apr 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-09 20:16

Updated : 2026-04-14 12:45

NVD link : CVE-2026-34486

Mitre link : CVE-2026-34486

CVE.ORG link : CVE-2026-34486

JSON object : View

Products Affected

apache

  • tomcat
CWE
CWE-311

Missing Encryption of Sensitive Data