Red Hat Product Errata RHSA-2026:38505 - Security Advisory Issued: 2026-07-13 Updated: 2026-07-13 RHSA-2026:38505 - Security Advisory Overview Updated Packages Synopsis Important: tomcat security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tomcat is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): Remove tomcat clustering JAR from RPM builds (JIRA:RHEL-183996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2457020 - CVE-2026-29146 Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor BZ - 2457027 - CVE-2026-34486 Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass RHEL-183996 - Remove tomcat clustering JAR from RPM builds CVEs CVE-2026-29146 CVE-2026-34486 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM tomcat-7.0.76-18.el7_9.src.rpm SHA-256: b2825d0172075f063ac3c735a3e6915dd3b93d81de6d08660f80d93ca60c12be x86_64 tomcat-7.0.76-18.el7_9.noarch.rpm SHA-256: 0de9787e8d0ac63c42c98babc6d8908f1e351cda48f64c603b2f721c9f0169da tomcat-admin-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 17921d7e5506a5e91af11fc022d26138e5a35904d94a82cd8754628ceab07176 tomcat-docs-webapp-7.0.76-18.el7_9.noarch.rpm SHA-256: 6ec2884604063400d7caf37c00d1415835ac19728d1584a54d362de37256e1d7 tomcat-el-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 9f0cdaa9714f59075a161acdf8e1a55f9001bcba27b93d321ef20eec5454df49 tomcat-javadoc-7.0.76-18.el7_9.noarch.rpm SHA-256: 0f38f11aa72c46c970107c453b0791d1f1b991490bbf4fec245e31567fdf7494 tomcat-jsp-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 2e8347fc5116354da2445da506da7ab7646ca4156d62e70be6c2061aaa890403 tomcat-jsvc-7.0.76-18.el7_9.noarch.rpm SHA-256: 55eb3de983cad8765d21fcf122a42fc11c5ae72ceb329273eea2ea061195d1ae tomcat-lib-7.0.76-18.el7_9.noarch.rpm SHA-256: 0ecfba1c91387986a42a767268a96b5965a67dea3a2979b8c374724e1b3e743e tomcat-servlet-3.0-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 4758ea202950b1961bb3db0879d6c5bac9f5574a348cb8a3c1b6e1272dc14e27 tomcat-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 85e1d480bda369f7b7de9218bb9f7db7526776159db1d940a183bf671ce657a8 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM tomcat-7.0.76-18.el7_9.src.rpm SHA-256: b2825d0172075f063ac3c735a3e6915dd3b93d81de6d08660f80d93ca60c12be s390x tomcat-7.0.76-18.el7_9.noarch.rpm SHA-256: 0de9787e8d0ac63c42c98babc6d8908f1e351cda48f64c603b2f721c9f0169da tomcat-admin-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 17921d7e5506a5e91af11fc022d26138e5a35904d94a82cd8754628ceab07176 tomcat-docs-webapp-7.0.76-18.el7_9.noarch.rpm SHA-256: 6ec2884604063400d7caf37c00d1415835ac19728d1584a54d362de37256e1d7 tomcat-el-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 9f0cdaa9714f59075a161acdf8e1a55f9001bcba27b93d321ef20eec5454df49 tomcat-javadoc-7.0.76-18.el7_9.noarch.rpm SHA-256: 0f38f11aa72c46c970107c453b0791d1f1b991490bbf4fec245e31567fdf7494 tomcat-jsp-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 2e8347fc5116354da2445da506da7ab7646ca4156d62e70be6c2061aaa890403 tomcat-jsvc-7.0.76-18.el7_9.noarch.rpm SHA-256: 55eb3de983cad8765d21fcf122a42fc11c5ae72ceb329273eea2ea061195d1ae tomcat-lib-7.0.76-18.el7_9.noarch.rpm SHA-256: 0ecfba1c91387986a42a767268a96b5965a67dea3a2979b8c374724e1b3e743e tomcat-servlet-3.0-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 4758ea202950b1961bb3db0879d6c5bac9f5574a348cb8a3c1b6e1272dc14e27 tomcat-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 85e1d480bda369f7b7de9218bb9f7db7526776159db1d940a183bf671ce657a8 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM tomcat-7.0.76-18.el7_9.src.rpm SHA-256: b2825d0172075f063ac3c735a3e6915dd3b93d81de6d08660f80d93ca60c12be ppc64 tomcat-7.0.76-18.el7_9.noarch.rpm SHA-256: 0de9787e8d0ac63c42c98babc6d8908f1e351cda48f64c603b2f721c9f0169da tomcat-admin-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 17921d7e5506a5e91af11fc022d26138e5a35904d94a82cd8754628ceab07176 tomcat-docs-webapp-7.0.76-18.el7_9.noarch.rpm SHA-256: 6ec2884604063400d7caf37c00d1415835ac19728d1584a54d362de37256e1d7 tomcat-el-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 9f0cdaa9714f59075a161acdf8e1a55f9001bcba27b93d321ef20eec5454df49 tomcat-javadoc-7.0.76-18.el7_9.noarch.rpm SHA-256: 0f38f11aa72c46c970107c453b0791d1f1b991490bbf4fec245e31567fdf7494 tomcat-jsp-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 2e8347fc5116354da2445da506da7ab7646ca4156d62e70be6c2061aaa890403 tomcat-jsvc-7.0.76-18.el7_9.noarch.rpm SHA-256: 55eb3de983cad8765d21fcf122a42fc11c5ae72ceb329273eea2ea061195d1ae tomcat-lib-7.0.76-18.el7_9.noarch.rpm SHA-256: 0ecfba1c91387986a42a767268a96b5965a67dea3a2979b8c374724e1b3e743e tomcat-servlet-3.0-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 4758ea202950b1961bb3db0879d6c5bac9f5574a348cb8a3c1b6e1272dc14e27 tomcat-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 85e1d480bda369f7b7de9218bb9f7db7526776159db1d940a183bf671ce657a8 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM tomcat-7.0.76-18.el7_9.src.rpm SHA-256: b2825d0172075f063ac3c735a3e6915dd3b93d81de6d08660f80d93ca60c12be ppc64le tomcat-7.0.76-18.el7_9.noarch.rpm SHA-256: 0de9787e8d0ac63c42c98babc6d8908f1e351cda48f64c603b2f721c9f0169da tomcat-admin-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 17921d7e5506a5e91af11fc022d26138e5a35904d94a82cd8754628ceab07176 tomcat-docs-webapp-7.0.76-18.el7_9.noarch.rpm SHA-256: 6ec2884604063400d7caf37c00d1415835ac19728d1584a54d362de37256e1d7 tomcat-el-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 9f0cdaa9714f59075a161acdf8e1a55f9001bcba27b93d321ef20eec5454df49 tomcat-javadoc-7.0.76-18.el7_9.noarch.rpm SHA-256: 0f38f11aa72c46c970107c453b0791d1f1b991490bbf4fec245e31567fdf7494 tomcat-jsp-2.2-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 2e8347fc5116354da2445da506da7ab7646ca4156d62e70be6c2061aaa890403 tomcat-jsvc-7.0.76-18.el7_9.noarch.rpm SHA-256: 55eb3de983cad8765d21fcf122a42fc11c5ae72ceb329273eea2ea061195d1ae tomcat-lib-7.0.76-18.el7_9.noarch.rpm SHA-256: 0ecfba1c91387986a42a767268a96b5965a67dea3a2979b8c374724e1b3e743e tomcat-servlet-3.0-api-7.0.76-18.el7_9.noarch.rpm SHA-256: 4758ea202950b1961bb3db0879d6c5bac9f5574a348cb8a3c1b6e1272dc14e27 tomcat-webapps-7.0.76-18.el7_9.noarch.rpm SHA-256: 85e1d480bda369f7b7de9218bb9f7db7526776159db1d940a183bf671ce657a8 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .