---
title: "Security digest: April 9, 2026"
url: https://erroneo.us/security/2026-04-09/
description: "April 9, 2026 vulnerability digest: 1 brief (Tomcat CVE-2026-34486: Cluster…); 3 critical advisories (crates.io (Rust), PyPI, Maven). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-09
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 9, 2026

1 editorial brief and 3 critical advisories.

## Take stock

- Check exposure: Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass . Anyone running Tomcat 11.0.20, 10.1.53 or 9.0.116 with a <Cluster> element and the EncryptInterceptor configured, especially where the Tribes receiver port (4000-4100 by default) is reachable beyond the cluster nodes.
- crates.io (Rust): 1 critical advisory ( wasmtime ). Check with cargo audit .
- PyPI: 1 critical advisory ( apache-airflow ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( org.apache.tomcat:tomcat , org.apache.tomcat:tomcat-coyote-ffm ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass](https://erroneo.us/security/briefs/apache-tomcat-cve-2026-34486-encryptinterceptor-bypass/index.md): Exploited, but only against three specific Tomcat releases running session-replication clustering with the EncryptInterceptor and a reachable cluster port; check those three things today, and most Tomcat users will find they are not exposed.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-34971](https://erroneo.us/security/cve/CVE-2026-34971/index.md) Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift — crates.io (Rust) wasmtime >= 32.0.0, < 36.0.7 → 36.0.7; crates.io (Rust) wasmtime >= 37.0.0, < 42.0.2 → 42.0.2; crates.io (Rust) wasmtime = 43.0.0 → 43.0.1
- [CVE-2025-57735](https://erroneo.us/security/cve/CVE-2025-57735/index.md) Apache Airflow: JWT token still valid after logout — PyPI apache-airflow >= 3.0.0, < 3.2.0 → 3.2.0
- [CVE-2026-29145](https://erroneo.us/security/cve/CVE-2026-29145/index.md) Apache Tomcat: CLIENT_CERT authentication does not fail as expected — Maven org.apache.tomcat:tomcat >= 9.0.83, < 9.0.116 → 9.0.116; Maven org.apache.tomcat:tomcat >= 10.1.0-M7, < 10.1.53 → 10.1.53; Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.20 → 11.0.20

---
Source page: https://erroneo.us/security/2026-04-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt