Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-29129

Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

VectorNETWORK

PublishedApr 09, 2026, 20:16

Published Bysecurity@apache.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.tomcat:tomcat-coyote(Maven)9.0.1149.0.116N/A

org.apache.tomcat:tomcat-coyote(Maven)10.1.5110.1.53N/A

org.apache.tomcat:tomcat-coyote(Maven)11.0.1611.0.20N/A

org.apache.tomcat:tomcat(Maven)9.0.1149.0.116N/A

org.apache.tomcat:tomcat(Maven)10.1.5110.1.53N/A

org.apache.tomcat:tomcat(Maven)11.0.1611.0.20N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)9.0.1149.0.116N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)10.1.5110.1.53N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)11.0.1611.0.20N/A

References

Weakness Type

CWE-327

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK