{
  "threat_severity" : "Low",
  "public_date" : "2026-04-09T19:19:40Z",
  "bugzilla" : {
    "description" : "Apache Tomcat: Apache Tomcat: Configured cipher preference order not preserved",
    "id" : "2457031",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2457031"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-15",
  "details" : [ "Configured cipher preference order not preserved vulnerability in Apache Tomcat.\nThis issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.", "A flaw was found in Apache Tomcat. This vulnerability occurs when the configured cipher preference order is not preserved. This could allow an attacker to bypass intended security configurations, potentially leading to a weakened security posture or information disclosure." ],
  "statement" : "Low impact. A flaw in Apache Tomcat allows the configured cipher preference order to be bypassed. This could lead to a server using a weaker cipher than intended, potentially reducing the security posture of TLS connections. This affects Red Hat Enterprise Linux systems running Apache Tomcat.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36790",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "tomcat9-1:9.0.117-2.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat6",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-deps:10.6/pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "fix_state" : "Not affected",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6",
    "fix_state" : "Not affected",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-29129\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-29129\nhttps://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f" ],
  "name" : "CVE-2026-29129",
  "mitigation" : {
    "value" : "Configure Apache Tomcat to explicitly allow only strong cipher suites. This ensures that even if the preference order is not strictly honored, only secure ciphers are utilized for TLS connections.\nEdit the `server.xml` file, typically located at `/etc/tomcat/server.xml` or `/opt/tomcat/conf/server.xml`, and modify the `<Connector>` element to include a `ciphers` attribute listing only approved strong cipher suites. For example:\n`<Connector port=\"8443\" protocol=\"org.apache.coyote.http11.Http11NioProtocol\" SSLEnabled=\"true\" scheme=\"https\" secure=\"true\" clientAuth=\"false\" sslProtocol=\"TLSv1.2+TLSv1.3\" ciphers=\"TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256\"/>`\nReplace the example cipher list with a comprehensive set of strong ciphers appropriate for your environment. This may impact compatibility with older clients that do not support the specified strong cipher suites.\nA restart of the Apache Tomcat service is required for the changes to take effect. Use the command `systemctl restart tomcat` or `systemctl restart tomcat9` depending on your installed package.",
    "lang" : "en:us"
  },
  "csaw" : false
}