CVE-2026-29146: Apache Tomcat Padding Oracle Vulnerability

CVE-2026-29146 Overview

A Padding Oracle vulnerability exists in Apache Tomcat's EncryptInterceptor when using the default configuration. This cryptographic vulnerability allows attackers to potentially decrypt sensitive data or forge encrypted messages by exploiting weaknesses in the padding validation mechanism during decryption operations.

Critical Impact

Attackers exploiting this Padding Oracle vulnerability can decrypt encrypted session data or cluster communications without possessing the encryption key, potentially leading to unauthorized access and data exposure across Tomcat cluster nodes.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.18
• Apache Tomcat 10.0.0-M1 through 10.1.52
• Apache Tomcat 9.0.13 through 9.0.115
• Apache Tomcat 8.5.38 through 8.5.100
• Apache Tomcat 7.0.100 through 7.0.109

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-29146 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-29146

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's EncryptInterceptor, a component used to encrypt messages between cluster nodes. When configured with default settings, the interceptor is susceptible to a Padding Oracle attack—a class of side-channel vulnerability that exploits differences in server responses when processing correctly versus incorrectly padded ciphertext.

In a Padding Oracle attack, an adversary sends modified ciphertext blocks to the target server and observes the responses. By analyzing whether the server returns a padding error versus a different type of error (or success), the attacker can iteratively deduce the plaintext without knowing the encryption key. This technique can be used to decrypt sensitive cluster communication data or forge valid encrypted messages.

The default configuration of EncryptInterceptor does not adequately protect against timing-based or error-based oracle conditions, making deployments using out-of-the-box settings particularly vulnerable.

Root Cause

The root cause stems from improper handling of padding validation errors in the EncryptInterceptor component. When decrypting cipher blocks using CBC (Cipher Block Chaining) mode with PKCS7 padding, the implementation reveals information about padding validity through distinguishable error responses or timing differences. This information leakage creates an oracle that attackers can query repeatedly to extract plaintext data.

Attack Vector

The attack requires network access to the Tomcat cluster communication channel. An attacker positioned to intercept or inject traffic between cluster nodes can:

1. Capture encrypted cluster messages
2. Modify ciphertext blocks systematically
3. Send modified ciphertext to the target Tomcat instance
4. Observe response patterns to determine padding validity
5. Iterate through all possible byte values to decrypt each byte of the message
6. Reconstruct the original plaintext or forge new valid encrypted messages

This attack is particularly dangerous in environments where the cluster channel is exposed to untrusted networks or where an attacker has achieved a foothold within the internal network.

Detection Methods for CVE-2026-29146

Indicators of Compromise

• Unusual volume of malformed or invalid encrypted messages in Tomcat cluster logs
• Repeated connection attempts from single sources with slight variations in request payloads
• Decryption error spikes in EncryptInterceptor-related log entries
• Anomalous network traffic patterns between cluster nodes indicating oracle probing activity

Detection Strategies

• Monitor Tomcat cluster communication logs for repeated decryption failures from the same source
• Implement anomaly detection for cluster traffic volume and error rate patterns
• Deploy network intrusion detection rules targeting Padding Oracle attack signatures
• Analyze timing patterns in cluster responses that may indicate oracle conditions

Monitoring Recommendations

• Enable detailed logging for the EncryptInterceptor component to capture decryption events
• Configure alerting thresholds for abnormal rates of encryption/decryption errors
• Implement network monitoring between cluster nodes to detect probing behavior
• Review cluster communication logs regularly for signs of systematic tampering attempts

How to Mitigate CVE-2026-29146

Immediate Actions Required

• Upgrade Apache Tomcat to patched versions: 11.0.19, 10.1.53, or 9.0.116
• Review EncryptInterceptor configuration and ensure it does not use vulnerable default settings
• Consider disabling cluster encryption temporarily if upgrade cannot be performed immediately (assess risk tradeoffs)
• Restrict network access to cluster communication ports to trusted sources only

Patch Information

Apache has released security updates that address this Padding Oracle vulnerability. Users are recommended to upgrade to the following fixed versions:

• Apache Tomcat 11.0.19 (for 11.x branch)
• Apache Tomcat 10.1.53 (for 10.x branch)
• Apache Tomcat 9.0.116 (for 9.x branch)

Users running Apache Tomcat 8.5.x or 7.0.x should consult the Apache Security Discussion Thread for additional guidance, as these branches may have reached end-of-life status.

Workarounds

• Implement network segmentation to isolate cluster communication from untrusted networks
• Use firewall rules to restrict access to cluster ports (default: 4000-4100) to only authorized cluster members
• Consider implementing additional transport-layer encryption (TLS/SSL) for cluster communication as defense-in-depth
• Monitor for and rate-limit repeated failed decryption attempts to slow oracle-based attacks