Every CVE Search/ Get API key

CVE-2026-29129

Apache Tomcat: TLS cipher order is not preserved

7.5 HighFix available

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.26%Up 0.2 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Apache Tomcat: TLS cipher order is not preserved

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
CVE-2026-29129
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-327
Updated
2026-11-02
EUVDEUVD-2026-21010 7.5

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
EUVD-2026-21010
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-69cc-cv78-qc8g 7.5

Apache Tomcat: Configured cipher preference order not preserved

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
GHSA-69cc-cv78-qc8g
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-327
Updated
2026-11-02
NVD 7.5

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
CVE-2026-29129
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-327
Updated
2026-11-02
OSV 7.5

Apache Tomcat: TLS cipher order is not preserved

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
CVE-2026-29129
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2026-29129 7.5

Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
DEBIAN-CVE-2026-29129
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 20 moreShow less
OSVGHSA-69cc-cv78-qc8g 7.5

Apache Tomcat: Configured cipher preference order not preserved

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
GHSA-69cc-cv78-qc8g
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-327
Updated
2026-11-02
OSVOESA-2026-1970 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-29129)

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.(CVE-2026-29145)

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.(CVE-2026-29146)

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-32990)

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.(CVE-2026-34483)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34486)

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34487)

CLIENT_CERT authentication does not fail as expected for some…

Record
OESA-2026-1970
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-29129 7.5

Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
UBUNTU-CVE-2026-29129
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:36790 No score

Important: tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  • Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

  • Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:36790
Updated
2026-11-02
OSVBIT-tomcat-2026-29129 No score

Apache Tomcat: TLS cipher order is not preserved

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Record
BIT-tomcat-2026-29129
Updated
2026-11-02
OSVMGASA-2026-0095 No score

Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. (CVE-2026-24880) Occasionally open redirect. (CVE-2026-25854) TLS cipher order is not preserved. (CVE-2026-29129) OCSP checks sometimes soft-fail even when soft-fail is disabled. (CVE-2026-29145) EncryptInterceptor vulnerable to padding oracle attack by default. (CVE-2026-29146) Fix for CVE-2025-66614 is incomplete. (CVE-2026-32990) Incomplete escaping of JSON access logs. (CVE-2026-34483) Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor. (CVE-2026-34486) Cloud membership for clustering component exposed the Kubernetes bearer token. (CVE-2026-34487) OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-34500)

Record
MGASA-2026-0095
Updated
2026-11-02
OSVopenSUSE-SU-2026:10547-1 No score

tomcat-9.0.117-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.117-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10547-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10548-1 No score

tomcat10-10.1.54-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.54-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10548-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10549-1 No score

tomcat11-11.0.21-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.21-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10549-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20595-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

  • Update to Tomcat 11.0.21
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
openSUSE-SU-2026:20595-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20611-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
openSUSE-SU-2026:20611-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20612-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

  • Update to Tomcat 10.1.54
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
openSUSE-SU-2026:20612-1
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-29129 No score

CVE-2026-29129 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-29129 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-29129
Updated
2026-11-02
OSVSUSE-SU-2026:1558-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 11.0.21
Record
SUSE-SU-2026:1558-1
Updated
2026-11-02
OSVSUSE-SU-2026:1572-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 9.0.117
Record
SUSE-SU-2026:1572-1
Updated
2026-11-02
OSVSUSE-SU-2026:1603-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 10.1.54
Record
SUSE-SU-2026:1603-1
Updated
2026-11-02
OSVSUSE-SU-2026:1604-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 9.0.117
Record
SUSE-SU-2026:1604-1
Updated
2026-11-02
OSVSUSE-SU-2026:21366-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

  • Update to Tomcat 11.0.21
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
SUSE-SU-2026:21366-1
Updated
2026-11-02
OSVSUSE-SU-2026:21378-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
SUSE-SU-2026:21378-1
Updated
2026-11-02
OSVSUSE-SU-2026:21379-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

  • Update to Tomcat 10.1.54
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
SUSE-SU-2026:21379-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 9.0.114 up to 9.0.116
9.0.116
org.apache.tomcat:tomcat
Maven
 10.1.51 up to 10.1.53
10.1.53
org.apache.tomcat:tomcat
Maven
 11.0.16 up to 11.0.20
11.0.20
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.114 up to 9.0.116
9.0.116
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.51 up to 10.1.53
10.1.53
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.16 up to 11.0.20
11.0.20
org.apache.tomcat:tomcat-coyote
Maven
 9.0.114 up to 9.0.116
9.0.116
org.apache.tomcat:tomcat-coyote
Maven
 10.1.51 up to 10.1.53
10.1.53
org.apache.tomcat:tomcat-coyote
Maven
 11.0.16 up to 11.0.20
11.0.20
tomcat9
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
Show 65 moreShow less
Affected packages
PackageAffectedFixed
tomcat9-admin-webapps
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-docs-webapp
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-el-3.0-api
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-jsp-2.3-api
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-lib
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-servlet-4.0-api
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-webapps
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat
Bitnami
 9.0.114 up to 9.0.116, 10.1.51 up to 10.1.53, 11.0.16 up to 11.0.20
9.0.11610.1.5311.0.20
tomcat10
Debian:12
 before 10.1.55-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 28 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.55-1~deb12u1
tomcat10
Debian:13
 before 10.1.55-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.55-1~deb12u1
10.1.55-1~deb13u1
tomcat10
Debian:14
 before 10.1.54-1, plus listed versions
10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-2
10.1.54-1
tomcat11
Debian:13
 before 11.0.22-1~deb13u1, plus listed versions
11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.21-111.0.6-1
11.0.22-1~deb13u1
tomcat11
Debian:14
 before 11.0.21-1, plus listed versions
11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.6-1
11.0.21-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
org.apache.tomcat:tomcat-coyote
Maven
 9.0.114 up to 9.0.116, plus listed versions
9.0.115
9.0.116
org.apache.tomcat:tomcat-coyote
Maven
 10.1.51 up to 10.1.53, plus listed versions
10.1.52
10.1.53
org.apache.tomcat:tomcat-coyote
Maven
 11.0.16 up to 11.0.20, plus listed versions
11.0.18
11.0.20
org.apache.tomcat:tomcat
Maven
 9.0.114 up to 9.0.116, plus listed versions
9.0.115
9.0.116
org.apache.tomcat:tomcat
Maven
 10.1.51 up to 10.1.53, plus listed versions
10.1.52
10.1.53
org.apache.tomcat:tomcat
Maven
 11.0.16 up to 11.0.20, plus listed versions
11.0.18
11.0.20
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.114 up to 9.0.116, plus listed versions
9.0.115
9.0.116
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.51 up to 10.1.53, plus listed versions
10.1.52
10.1.53
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.16 up to 11.0.20, plus listed versions
11.0.18
11.0.20
tomcat
Mageia:9
 before 9.0.117-1.mga9
9.0.117-1.mga9
tomcat
openEuler:24.03-LTS-SP3
 before 9.0.117-1.oe2403sp3
9.0.117-1.oe2403sp3
tomcat
openEuler:20.03-LTS-SP4
 before 9.0.117-1.oe2003sp4
9.0.117-1.oe2003sp4
tomcat
openEuler:22.03-LTS-SP4
 before 9.0.117-1.oe2203sp4
9.0.117-1.oe2203sp4
tomcat
openEuler:24.03-LTS
 before 9.0.117-1.oe2403sp2
9.0.117-1.oe2403sp2
tomcat
openEuler:24.03-LTS-SP1
 before 9.0.117-1.oe2403sp1
9.0.117-1.oe2403sp1
tomcat
openEuler:24.03-LTS-SP2
 before 9.0.117-1.oe2403sp2
9.0.117-1.oe2403sp2
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.52-aikido.3
10.1.52-aikido.310.1.52-aikido.211.0.20-aikido.1510.1.53-aikido.911.0.20-aikido.1210.1.53-aikido.1011.0.20-aikido.1611.0.20-aikido.1311.0.20-aikido.14
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.52-root.io.3
10.1.52-root.io.310.1.52-root.io.211.0.20-root.io.111.0.20-root.io.611.0.20-root.io.711.0.20-root.io.811.0.20-root.io.910.1.53-root.io.310.1.53-root.io.411.0.20-root.io.1010.1.53-root.io.510.1.53-root.io.611.0.20-root.io.1111.0.20-root.io.1510.1.53-root.io.710.1.53-root.io.810.1.53-root.io.911.0.20-root.io.1210.1.53-root.io.1011.0.20-root.io.1611.0.20-root.io.1311.0.20-root.io.14
tomcat11
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat11
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat11
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 9.0.117-3.163.2
9.0.117-3.163.2
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.0.117-3.163.2
9.0.117-3.163.2
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat9
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0.95-1ubuntu19.0.111-19.0.115-19.0.115-1ubuntu0.19.0.118-1~26.04.1
 None known
tomcat11
Ubuntu:26.04:LTS
 All versions, plus listed versions
11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1
 None known
tomcat
openSUSE:Tumbleweed
 before 9.0.117-1.1
9.0.117-1.1
tomcat10
openSUSE:Tumbleweed
 before 10.1.54-1.1
10.1.54-1.1
tomcat11
openSUSE:Tumbleweed
 before 11.0.21-1.1
11.0.21-1.1
tomcat11
openSUSE:Leap 16.0
 before 11.0.21-160000.1.1
11.0.21-160000.1.1
tomcat
openSUSE:Leap 16.0
 before 9.0.117-160000.1.1
9.0.117-160000.1.1
tomcat10
openSUSE:Leap 16.0
 before 10.1.54-160000.1.1
10.1.54-160000.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-29129 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in org.apache.tomcat:tomcat 9.0.116.

References

Show 74 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open