CVE-2026-55955

MEDIUM

Apache Tomcat: EncryptInterceptor not protected against replay attacks

Title source: cna
STIX 2.1

Description

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0028
EPSS Percentile 19.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-287
Status published
Products (6)
apache/tomcat < 9.0.19
Apache Software Foundation/Apache Tomcat 10.1.0-M1 - 10.1.55
Apache Software Foundation/Apache Tomcat 11.0.0-M1 - 11.0.22
Apache Software Foundation/Apache Tomcat 7.0.100 - 7.0.109
Apache Software Foundation/Apache Tomcat 8.5.38 - 8.5.100
Apache Software Foundation/Apache Tomcat 9.0.13 - 9.0.118
Published Jun 29, 2026
Tracked Since Jun 30, 2026