Skip to main content

Apache Tomcat EUVDEUVD-2026-40231

| CVE-2026-55955 MEDIUM
Improper Authentication (CWE-287)
2026-06-29 apache GHSA-c5ph-rghf-fjfj
Authentication Bypass Apache Red Hat Tomcat Suse Apache Tomcat Apache Software Foundation
6.5
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
6.5 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
8.0 HIGH

Adjacent network required for cluster channel access; High complexity for capture-then-replay prerequisite; Scope changes as replayed messages affect multiple cluster nodes; no availability impact directly from replay.

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE
4.2 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.2 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
CVSS changed
Jun 30, 2026 - 14:22 NVD
6.5 (MEDIUM)
Analysis Generated
Jun 29, 2026 - 21:19 vuln.today

DescriptionCVE.org

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

AnalysisAI

Replay attack vulnerability in Apache Tomcat's cluster EncryptionInterceptor allows a network-adjacent attacker to retransmit previously captured encrypted inter-node cluster messages, causing receiving nodes to accept and process them as legitimate - potentially corrupting distributed session state or triggering unintended cluster actions. All major supported branches are affected: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.18, plus end-of-life branches 8.5.38-8.5.100 and 7.0.100-7.0.109. No public exploit or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions across all active and legacy branches elevates organizational exposure, particularly for environments running EOL 8.5.x or 7.x with no available patch.

Technical ContextAI

Apache Tomcat's cluster component supports distributed session replication across multiple Tomcat instances using a pluggable interceptor pipeline. The EncryptionInterceptor is an optional cluster interceptor that encrypts inter-node cluster channel traffic. CWE-287 (Improper Authentication) indicates the interceptor's cryptographic scheme lacks anti-replay protections - such as sequence numbers, monotonic timestamps, or nonces - meaning valid encrypted messages can be captured and retransmitted without detection. The cluster channel typically operates over multicast or dedicated TCP (default port 4000), and is generally confined to an internal network segment. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_tomcat across the listed version ranges spanning the 7.x, 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. Note: the 9.0.x affected range (9.0.13-9.0.18) versus the stated fix version (9.0.119) represents an unusually large gap that may indicate a data entry error in the CVE record - this discrepancy is flagged in confidence notes.

RemediationAI

Upgrade to Apache Tomcat 11.0.23, 10.1.56, or 9.0.119 - the vendor-confirmed fixed releases per the Apache mailing list advisory at https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106. For organizations running EOL branches 8.5.x or 7.0.x, for which no patch is available, the primary compensating control is to remove the EncryptionInterceptor from the cluster interceptor pipeline entirely; this eliminates the vulnerable component but removes encryption of cluster traffic, so it must be paired with a network-level encryption alternative such as IPSec tunnels or a dedicated VPN between cluster nodes. Additionally, enforce strict network access controls (firewall rules, VLAN segmentation) so that the cluster communication port is reachable only from trusted Tomcat nodes - this reduces replay attack opportunity by limiting attacker access to the cluster channel. Migration to a supported Tomcat branch remains the only durable fix for EOL users.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2022-29885 HIGH POC
7.5 May 12

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78

CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

EUVD-2026-40231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy