The Apache Software Foundation has released critical security updates for Apache Tomcat to address three newly disclosed vulnerabilities.
Because Apache Tomcat is a widely deployed open-source web server, these flaws pose a significant risk to many enterprise environments.
The newly discovered vulnerabilities could allow attackers to compromise encrypted communications, exploit flawed patches, and bypass client certificate authentication.
System administrators are strongly urged to review the official advisories and apply the necessary patches to secure their web infrastructure.
Security researchers Uri Katz and Avi Lumelsky from Oligo Security discovered an important severity vulnerability in Apache Tomcat’s EncryptInterceptor.
By default, this component utilized Cipher Block Chaining (CBC) mode, which inadvertently exposed the server to padding oracle attacks.
In simple terms, a padding oracle attack allows malicious actors to slowly decrypt intercepted traffic by analyzing how the server responds to incorrectly padded data requests.
This cryptographic weakness ultimately enables attackers to manipulate encrypted session data. This flaw impacts the following Apache Tomcat versions:
While developers attempted to patch the padding oracle vulnerability, an error in their code introduced a new, important severity issue.
Identified by Bartlomiej Dmitruk from striga.ai, this subsequent vulnerability allows attackers to completely bypass the EncryptInterceptor.
Because the initial security fix for CVE-2026-29146 was flawed, systems running the specific patched releases remain exposed to traffic interception and tampering risks.
This highlights the importance of rapidly deploying secondary patches when incomplete fixes are identified. The following versions contain this bypass vulnerability:
The third vulnerability, discovered by Haruki Oyama at Waseda University, carries a moderate severity rating and involves digital certificate validation.
Online Certificate Status Protocol (OCSP) checks are designed to verify if a client certificate has been revoked.
However, when the Foreign Function & Memory API (FFM) was used and the soft-fail feature was explicitly disabled, these checks would still occasionally soft-fail.
Consequently, client certificate authentication mistakenly trusted potentially invalid certificates, failing to block unauthorized access as expected. This authentication bypass affects these versions:
To resolve all three vulnerabilities, the Apache Software Foundation highly recommends that users immediately upgrade their server environments.
System administrators must upgrade to Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117, depending on their current release branch.
Implementing these latest software releases will ensure that the EncryptInterceptor functions securely and that client certificate authentication behaves as strictly configured.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…