CVE-2026-55955

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/29/24	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::

History

10 Jul 2026, 12:22

Type	Values Removed	Values Added
References	~~() https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106 - Vendor Advisory, Mailing List~~	() https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106 - Mailing List, Vendor Advisory

02 Jul 2026, 19:04

Type	Values Removed	Values Added
CPE		cpe:2.3:a:apache:tomcat::::::::
References	~~() https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106 -~~	() https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106 - Vendor Advisory, Mailing List
References	~~() http://www.openwall.com/lists/oss-security/2026/06/29/24 -~~	() http://www.openwall.com/lists/oss-security/2026/06/29/24 - Third Party Advisory
First Time		Apache tomcat Apache

30 Jun 2026, 14:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5

29 Jun 2026, 23:16

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/06/29/24 -

29 Jun 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-29 21:16

Updated : 2026-07-10 12:22

NVD link : CVE-2026-55955

Mitre link : CVE-2026-55955

CVE.ORG link : CVE-2026-55955

JSON object : View

Products Affected

apache

tomcat

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-55955", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55955", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T13:21:53.082121Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "versionType": "semver", "lessThanOrEqual": "11.0.22"}, {"status": "affected", "version": "10.1.0-M1", "versionType": "semver", "lessThanOrEqual": "10.1.55"}, {"status": "affected", "version": "9.0.13", "versionType": "semver", "lessThanOrEqual": "9.0.118"}, {"status": "affected", "version": "8.5.38", "versionType": "semver", "lessThanOrEqual": "8.5.100"}, {"status": "affected", "version": "7.0.100", "versionType": "semver", "lessThanOrEqual": "7.0.109"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-29T21:16:45.490", "references": [{"url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/29/24", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue."}], "lastModified": "2026-07-10T12:22:23.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E", "versionEndExcluding": "9.0.119"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D", "versionEndExcluding": "10.1.56", "versionStartIncluding": "10.1.0"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1", "versionEndExcluding": "11.0.23", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}