{"action":"Upgrade org.apache.tomcat:tomcat-tribes to 9.0.116 (9.x), 10.1.53 (10.x) or 11.0.20 (11.x) or later.","affected":[{"fixed":"9.0.116","introduced":"9.0.13"},{"fixed":"10.1.53","introduced":"10.1.50"},{"fixed":"11.0.20","introduced":"11.0.0-M1"},{"introduced":"8.5.38","last_affected":"8.5.100"},{"introduced":"7.0.100","last_affected":"7.0.109"}],"component":"org.apache.tomcat:tomcat-tribes","cve_ids":["CVE-2026-29146"],"ecosystem":"Maven","epss":0.0885,"exploited":false,"fixed_versions":["9.0.116","10.1.53","11.0.20"],"ghsa_id":"GHSA-h468-7pvh-8vr8","id":"tcs_01M5N8ZK0EEXB4HT1TGB4K3JP0","modified_at":"2026-09-10T03:51:02.273596864Z","published_at":"2026-04-09T21:31:29Z","references":["https://osv.dev/vulnerability/GHSA-h468-7pvh-8vr8","https://nvd.nist.gov/vuln/detail/CVE-2026-29146","https://github.com/apache/tomcat/commit/0112ed22abfccc3d54e44d91eb08804d0886acd1","https://github.com/apache/tomcat/commit/607ebc0fa522bd9e8c05517baa2d179bbd1e659c","https://github.com/apache/tomcat/commit/6d955cceca841f2eabf2d6c46b59a8c7e1cd6eaa","https://github.com/apache/tomcat","https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116","https://www.herodevs.com/vulnerability-directory/cve-2026-29146","http://www.openwall.com/lists/oss-security/2026/04/09/24"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h468-7pvh-8vr8","url":"https://osv.dev/vulnerability/GHSA-h468-7pvh-8vr8"}],"summary":"Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor"}