CVE-2026-55955CWE-287

Apache Tomcat: EncryptInterceptor not protected against replay attacks

Medium · published June 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-06-29T20:44Z
EPSS history
Timeline
  • 29 JUN 20:44Z
    Apache Tomcat: EncryptInterceptor not protected against replay attacks
    cvelistv5