VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published Apr 9, 2026· Updated Apr 14, 2026

CVE-2026-34486

CVE-2026-34486

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-tribesMaven
>= 11.0.20, < 11.0.2111.0.21
org.apache.tomcat:tomcat-tribesMaven
>= 10.1.53, < 10.1.5410.1.54
org.apache.tomcat:tomcat-tribesMaven
>= 9.0.116, < 9.0.1179.0.117
org.apache.tomcat:tomcatMaven
>= 11.0.20, < 11.0.2111.0.21
org.apache.tomcat:tomcatMaven
>= 10.1.53, < 10.1.5410.1.54
org.apache.tomcat:tomcatMaven
>= 9.0.116, < 9.0.1179.0.117

Affected products

3
  • Apache/Tomcat3 versions
    cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*

Patches

3
1fab40ccc752

Better error handling - partial revert of 6d955cc

https://github.com/apache/tomcatMark ThomasMar 30, 2026via ghsa
commit
2 files changed · +4 −1
  • java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java+1 −1 modified
    @@ -140,10 +140,10 @@ public void messageReceived(ChannelMessage msg) {
             xbb.clear();
             xbb.append(data, 0, data.length);
 
+            super.messageReceived(msg);
         } catch (GeneralSecurityException gse) {
             log.error(sm.getString("encryptInterceptor.decrypt.failed"), gse);
         }
-        super.messageReceived(msg);
     }
 
     /**
  • webapps/docs/changelog.xml+3 −0 modified
    @@ -142,6 +142,9 @@
         Reduce log verbosity of the Kubernetes connection attempts and failure.
         (remm)
       </fix>
+      <fix>
+        Better error handling for the <code>EncryptInterceptor</code>. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Other">
776e12b3e2b0

Better error handling - partial revert of 607ebc0

https://github.com/apache/tomcatMark ThomasMar 30, 2026via ghsa
commit
2 files changed · +4 −1
  • java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java+1 −1 modified
    @@ -139,10 +139,10 @@ public void messageReceived(ChannelMessage msg) {
             xbb.clear();
             xbb.append(data, 0, data.length);
 
+            super.messageReceived(msg);
         } catch (GeneralSecurityException gse) {
             log.error(sm.getString("encryptInterceptor.decrypt.failed"), gse);
         }
-        super.messageReceived(msg);
     }
 
     /**
  • webapps/docs/changelog.xml+3 −0 modified
    @@ -146,6 +146,9 @@
         Reduce log verbosity of the Kubernetes connection attempts and failure.
         (remm)
       </fix>
+      <fix>
+        Better error handling for the <code>EncryptInterceptor</code>. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Other">
55f3eb914823

Better error handling - partial revert of 607ebc0

https://github.com/apache/tomcatMark ThomasMar 30, 2026via ghsa
commit
2 files changed · +4 −1
  • java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java+1 −1 modified
    @@ -139,10 +139,10 @@ public void messageReceived(ChannelMessage msg) {
             xbb.clear();
             xbb.append(data, 0, data.length);
 
+            super.messageReceived(msg);
         } catch (GeneralSecurityException gse) {
             log.error(sm.getString("encryptInterceptor.decrypt.failed"), gse);
         }
-        super.messageReceived(msg);
     }
 
     /**
  • webapps/docs/changelog.xml+3 −0 modified
    @@ -146,6 +146,9 @@
         Reduce log verbosity of the Kubernetes connection attempts and failure.
         (remm)
       </fix>
+      <fix>
+        Better error handling for the <code>EncryptInterceptor</code>. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Other">

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.