Apache Tomcat: TLS cipher order is not preserved_CVE-2026-29129

7.5 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Basic Information

ID CVE-2026-29129

Source apache

Published Apr 9, 2026 at 19:19

Modified Apr 10, 2026 at 18:06

Affected Product

Vendor Apache Software Foundation

Product Apache Tomcat

Version 11.0.16

Affected Versions Apache Software Foundation Apache Tomcat 11.0.16
Apache Software Foundation Apache Tomcat 10.1.51
Apache Software Foundation Apache Tomcat 9.0.114

CWE Classification

CWE-327

References

lists.apache.org /thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f

{
    "lastseen": "",
    "description": "Configured cipher preference order not preserved vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.",
    "published": "2026-04-09T19:19:40.645Z",
    "modified": "2026-04-10T18:06:45.771Z",
    "type": "cve",
    "title": "Apache Tomcat: TLS cipher order is not preserved",
    "source": "apache",
    "references": "https://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f",
    "id": "CVE-2026-29129",
    "bulletinFamily": "",
    "cwe": [
        "CWE-327"
    ],
    "cvelist": null,
    "sourceData": "Apache Software Foundation Apache Tomcat 11.0.16\nApache Software Foundation Apache Tomcat 10.1.51\nApache Software Foundation Apache Tomcat 9.0.114",
    "sourceHref": "",
    "cvss": {
        "score": 7.5,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Apache Tomcat",
    "version": "11.0.16",
    "vendor": "Apache Software Foundation",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}