PT-2026-31712 · Apache · Apache Tomcat

Published 2026-04-09 · Updated 2026-04-14 · CVE-2026-34486

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116

Description A missing encryption of sensitive data issue exists in Apache Tomcat due to a bypass of the EncryptInterceptor. This could expose sensitive data.

Recommendations Upgrade to version 11.0.21 Upgrade to version 10.1.54 Upgrade to version 9.0.117

Fix

RCE

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

BIT-TOMCAT-2026-34486

CVE-2026-34486

GHSA-69R9-QGR7-G2WJ

MGASA-2026-0095

Affected Products

Apache Tomcat

References · 28

• https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69r9-qgr7-g2wj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34486 · Security Note
• https://osv.dev/vulnerability/BIT-tomcat-2026-34486 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0095 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0095.html · Security Note
• https://github.com/apache/tomcat · Note
• https://twitter.com/pulsepatchio/status/2043531905413333248 · Twitter Post
• https://twitter.com/zoomeye_team/status/2043985200993190137 · Twitter Post
• https://twitter.com/modat_magnify/status/2044011682297458870 · Twitter Post
• https://openwall.com/lists/oss-security/2026/04/09/21 · Note
• https://openwall.com/lists/oss-security/2026/04/09/22 · Note
• https://bugs.mageia.org/show_bug.cgi?id=35341 · Note
• https://twitter.com/fofabot/status/2043893179796324701 · Twitter Post
• https://openwall.com/lists/oss-security/2026/04/09/29 · Note