DeutschShown in its original language — a full translation is planned for a future version.
Apache Tomcat und Tomcat Native: Mehrere Schwachstellen
view advisory published 2026-04-09
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuführen und andere, nicht näher spezifizierte Angriffe auszuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34500US | — | — | ||
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-… | ||||
| CVE-2026-34487US | — | — | ||
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.
This issue af… | ||||
| CVE-2026-34486US | —OT critical | KEV | ||
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomc… | ||||
| CVE-2026-34483US | — | — | ||
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from… | ||||
| CVE-2026-32990US | — | — | ||
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.
This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 t… | ||||
| CVE-2026-29146US | — | — | ||
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 thr… | ||||
| CVE-2026-29145US | — | Exploit | ||
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache… | ||||
| CVE-2026-29129US | —OT elevated | — | ||
Configured cipher preference order not preserved vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from… | ||||
| CVE-2026-25854US | — | Exploit | ||
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.
This issue affects Apache Tomcat: from 11.0.0-M1 t… | ||||
| CVE-2026-24880US | — | Exploit | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.
This issue affects Apache Tomcat: from… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:12194 vom 2026-04-30external
- Red Hat Security Advisory RHSA-2026:12195 vom 2026-04-30external
- Red Hat Security Advisory RHSA-2026:20405 vom 2026-05-26external
- Red Hat Security Advisory RHSA-2026:20406 vom 2026-05-26external
- Red Hat Security Advisory RHSA-2026:36789 vom 2026-07-08external
- Red Hat Security Advisory RHSA-2026:36790 vom 2026-07-08external
- Red Hat Security Advisory RHSA-2026:36876 vom 2026-07-09external
- Red Hat Security Advisory RHSA-2026:36877 vom 2026-07-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan