# CVE-2026-34486: tomcat: Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the by...

CVE-2026-34486 is fixed in 22 products on 1 platform, first by RHSA-2026:36787, released April 9, 2026. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on August 4, 2026. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/cve/CVE-2026-34486
- Priority: Patch now
- CVSS: 7.5 (important)
- EPSS: 0.9850
- CISA KEV: listed Aug 4, 2026, federal due date Aug 7, 2026
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 9, 2026

## Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | jws7-tomcat RHEL 10 | 11.0.21-5.redhat_00004.1.el10jws | [RHSA-2026:39188](https://patchblox.com/security/data/fix/linux/rhsa-2026-39188.md) | Jul 18, 2026 |
| Linux | tomcat RHEL 10 | 10.1.36-2.el10_0 | [RHSA-2026:36787](https://patchblox.com/security/data/fix/linux/rhsa-2026-36787.md) | Apr 9, 2026 |
| Linux | tomcat RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat opensuse-leap 16.0 | 9.0.117-160000.1.1 | [OPENSUSE-SU-2026:20611-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20611-1.md) | Apr 22, 2026 |
| Linux | tomcat rocky 10 | 1:10.1.49-3.el10_2 | [RLSA-2026:36788](https://patchblox.com/security/data/fix/linux/rlsa-2026-36788.md) | Jul 10, 2026 |
| Linux | tomcat rocky 8 | 1:9.0.87-2.el8_10 | [RLSA-2026:37137](https://patchblox.com/security/data/fix/linux/rlsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat rocky 9 | 1:9.0.117-2.el9_8 | [RLSA-2026:36879](https://patchblox.com/security/data/fix/linux/rlsa-2026-36879.md) | Jul 10, 2026 |
| Linux | tomcat sles 15.6 | 9.0.117-150200.105.1 | [SUSE-SU-2026:1604-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1604-1.md) | Apr 24, 2026 |
| Linux | tomcat sles 15.7 | 9.0.117-150200.105.1 | [SUSE-SU-2026:1604-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1604-1.md) | Apr 24, 2026 |
| Linux | tomcat-admin-webapps RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-admin-webapps RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-admin-webapps almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-admin-webapps almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-admin-webapps almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-admin-webapps ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-admin-webapps ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-admin-webapps ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-docs-webapp RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-docs-webapp RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-docs-webapp almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-docs-webapp almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-docs-webapp almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-docs-webapp ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-docs-webapp ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-docs-webapp ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-el-3.0-api RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-el-3.0-api RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-el-3.0-api almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-el-3.0-api almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-el-3.0-api ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-el-3.0-api ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-el-5.0-api almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-el-5.0-api ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-jsp-2.3-api RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-jsp-2.3-api RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-jsp-2.3-api almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-jsp-2.3-api almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-jsp-2.3-api ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-jsp-2.3-api ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-jsp-3.1-api almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-jsp-3.1-api ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-lib RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-lib RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-lib almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-lib almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-lib almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-lib ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-lib ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-lib ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-4.0-api RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-servlet-4.0-api RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-servlet-4.0-api almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-servlet-4.0-api almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-4.0-api ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-servlet-4.0-api ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-6.0-api almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-6.0-api ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-webapps RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-webapps RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-webapps almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-webapps almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-webapps almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-webapps ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-webapps ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-webapps ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat10 opensuse-leap 16.0 | 10.1.54-160000.1.1 | [OPENSUSE-SU-2026:20612-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20612-1.md) | Apr 22, 2026 |
| Linux | tomcat10 sles 15.6 | 10.1.54-150200.5.64.1 | [SUSE-SU-2026:1603-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1603-1.md) | Apr 24, 2026 |
| Linux | tomcat10 sles 15.7 | 10.1.54-150200.5.64.1 | [SUSE-SU-2026:1603-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1603-1.md) | Apr 24, 2026 |
| Linux | tomcat11 opensuse-leap 16.0 | 11.0.21-160000.1.1 | [OPENSUSE-SU-2026:20595-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20595-1.md) | Apr 21, 2026 |
| Linux | tomcat11 sles 15.6 | 11.0.21-150600.13.18.1 | [SUSE-SU-2026:1558-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1558-1.md) | Apr 22, 2026 |
| Linux | tomcat11 sles 15.7 | 11.0.21-150600.13.18.1 | [SUSE-SU-2026:1558-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1558-1.md) | Apr 22, 2026 |
| Linux | tomcat9 RHEL 10 | 9.0.87-6.el10_0 | [RHSA-2026:36789](https://patchblox.com/security/data/fix/linux/rhsa-2026-36789.md) | Apr 9, 2026 |
| Linux | tomcat9 almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9 ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9 rocky 10 | 1:9.0.117-2.el10_2 | [RLSA-2026:36790](https://patchblox.com/security/data/fix/linux/rlsa-2026-36790.md) | Jul 10, 2026 |
| Linux | tomcat9-admin-webapps almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-admin-webapps ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-docs-webapp almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-docs-webapp ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-el-3.0-api almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-el-3.0-api ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-jsp-2.3-api almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-jsp-2.3-api ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-lib almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-lib ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-servlet-4.0-api almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-servlet-4.0-api ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-webapps almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-webapps ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.