RHSA-2026:36876HighCVSS 7.5

Red Hat Security Advisory: tomcat security update

Published
July 8, 2026
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2026-29146 →CVE-2026-34486 →

📋 Description

CVE-2026-29146 — Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-34486 — Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass

🎯 Affected products10

  • Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-1:9.0.87-2.el9_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-admin-webapps-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-docs-webapp-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-el-3.0-api-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-jsp-2.3-api-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-lib-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-servlet-4.0-api-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • tomcat-webapps-1:9.0.87-2.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This vulnerability can be mitigated by removing the affected jar file from the tomcat installation. It can be achieved by running the following command as root: ~~~ systemctl stop tomcat rm -fv /usr/share/java/tomcat/catalina-tribes.jar systemctl start tomcat ~~~ It's important to notice if the Tomcat instance is configured to run with clustering, this may lead to errors when restarting the tomcat service. Red Hat's distributed Apache Tomcat should not be run with Clustering enabled, so make sure to disable such configuration before proceed with the mitigation if that's the case. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (5)