CVE-2026-29129

Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/22	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de orden de preferencia de cifrado configurado no preservado en Apache Tomcat. Este problema afecta a Apache Tomcat: desde 11.0.16 hasta 11.0.18, desde 10.1.51 hasta 10.1.52, desde 9.0.114 hasta 9.0.115. Se recomienda a los usuarios actualizar a la versión 11.0.20, 10.1.53 o 9.0.116, que solucionan el problema.

Information

Published : 2026-04-09 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-29129

Mitre link : CVE-2026-29129

CVE.ORG link : CVE-2026-29129

JSON object : View

Products Affected

apache

tomcat

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2026-29129", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29129", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:05:39.544150Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.16", "versionType": "semver", "lessThanOrEqual": "11.0.18"}, {"status": "affected", "version": "10.1.51", "versionType": "semver", "lessThanOrEqual": "10.1.52"}, {"status": "affected", "version": "9.0.114", "versionType": "semver", "lessThanOrEqual": "9.0.115"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T20:16:24.343", "references": [{"url": "https://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/22", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "Configured cipher preference order not preserved vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue."}, {"lang": "es", "value": "Vulnerabilidad de orden de preferencia de cifrado configurado no preservado en Apache Tomcat.\n\nEste problema afecta a Apache Tomcat: desde 11.0.16 hasta 11.0.18, desde 10.1.51 hasta 10.1.52, desde 9.0.114 hasta 9.0.115.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 11.0.20, 10.1.53 o 9.0.116, que solucionan el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1095386-8BA2-47E5-BD8D-F5E9A0A80D88", "versionEndExcluding": "9.0.116", "versionStartIncluding": "9.0.114"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69F68887-B315-49A2-94D5-7A9ED489BE58", "versionEndExcluding": "10.1.53", "versionStartIncluding": "10.1.51"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB642368-D598-4F14-88F8-D55CE2C97657", "versionEndExcluding": "11.0.20", "versionStartIncluding": "11.0.16"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}