The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-webapps | Jul 9, 2026 | Jul 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-webapps | May 20, 2026 | May 20, 2026 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.116Upgrade Apache Tomcat to 11.0.20Upgrade Apache Tomcat to 10.1.53Upgrade Apache Tomcat to the latest available version | Apr 10, 2026 | Apr 9, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Jul 22, 2026 | Jul 21, 2026 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9Upgrade tomcat11 | Apr 13, 2026 | Apr 13, 2026 |
| Redhat_linux | — | Upgrade jws7-buildUpgrade jws7-ecjUpgrade tomcat-javadocUpgrade jws6-tomcat-javadocUpgrade tomcat-el-5.0-apiUpgrade jws7-tomcat-libUpgrade jws6-tomcat-docs-webappUpgrade tomcatUpgrade tomcat9-docs-webappUpgrade jws7-tomcat-vault-javadocUpgrade tomcat-admin-webappsUpgrade tomcat9-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade jws6-tomcatUpgrade tomcat9-servlet-4.0-apiUpgrade jws7-tomcatUpgrade jws7-mod_clusterUpgrade tomcat-jsp-2.2-apiUpgrade tomcat9-libUpgrade jws7-tomcat-servlet-6.0-apiUpgrade jws7-tomcat-jsp-3.1-apiUpgrade jws6-tomcat-libUpgrade tomcat-docs-webappUpgrade jws7-runtimeUpgrade jws7-tomcat-javadocUpgrade tomcat-jsp-2.3-apiUpgrade tomcat9-el-3.0-apiUpgrade jws7-tomcat-vaultUpgrade jws7-tomcat-native-debuginfoUpgrade tomcat-servlet-4.0-apiUpgrade jws6-tomcat-servlet-6.0-apiUpgrade tomcat-webappsUpgrade jws6-tomcat-el-5.0-apiUpgrade tomcat9Upgrade tomcat-libUpgrade tomcat9-jsp-2.3-apiUpgrade tomcat-servlet-6.0-apiUpgrade tomcat-jsp-3.1-apiNo solution existsUpgrade tomcat9-webappsUpgrade jws7-tomcat-docs-webappUpgrade jws7-tomcat-el-5.0-apiUpgrade jws7-jboss-loggingUpgrade jws7-tomcat-selinuxUpgrade jws7-javapackages-toolsUpgrade tomcat-jsvcUpgrade jws7-javapackages-filesystemUpgrade tomcat-el-2.2-apiUpgrade jws7-mod_cluster-tomcatUpgrade jws6-tomcat-admin-webappsUpgrade jws6-tomcat-selinuxUpgrade jws7-tomcat-webappsUpgrade jws7-tomcat-admin-webappsUpgrade jws7-python3-javapackagesUpgrade jws6-tomcat-webappsUpgrade jws6-tomcat-jsp-3.1-apiUpgrade tomcat-servlet-3.0-apiUpgrade jws7-tomcat-native | May 28, 2026 | Apr 9, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub