Apache · Tomcat
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
무엇인가
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CISA: Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
할 일
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
미국 연방 기관 조치 기한: 2026년 8월 7일
Apache의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2025. 4. 1. | Path Equivalence | Tomcat | 치명적 10.0 | 99.9% |
| 2023. 5. 12. | Remote Code Execution | Tomcat | 치명적 9.8 | 90% |
| 2022. 3. 25. | on Windows Remote Code Execution | Tomcat | 높음 8.1 | 99.7% |
| 2022. 3. 25. | Remote Code Execution | Tomcat | 높음 8.1 | >99.9% |
| 2022. 3. 3. | Improper Privilege Management | Tomcat | 치명적 9.8 | 99.3% |
| 2026. 10. 8. | Command Injection | Struts | 높음 8.1 | 97% |
| 2026. 4. 16. | Improper Input Validation | ActiveMQ | 높음 8.8 | 98% |
| 2025. 5. 1. | Improper Escaping of Output | HTTP Server | 치명적 9.1 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.