ORG.APACHE.TOMCAT:TOMCAT · CVE-2026-55955 · Runtime
FIX → 11.0.23 · 10.1.56 · 9.0.119
Apache Tomcat's cluster EncryptionInterceptor can be abused in a replay attack because of an authentication flaw. An attacker who can capture and resend cluster traffic can get past the intended protection.
first public Jun 29, 2026 · 1 source
Running Org.apache.tomcat:tomcat? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only deployments that run Tomcat in a cluster and use the EncryptionInterceptor in the cluster component are exposed. Standalone Tomcat servers that do not cluster can skip this issue. Versions 8.5.x and 7.0.x have no fixed release in the sources.
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.118, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
Not affected if no-cluster-encryption-interceptor, standalone-tomcat
Who cares apache-tomcat, clustering, cwe-287, java
grep -ri EncryptionInterceptor $CATALINA_BASE/conf to see whether clustering with the encryption interceptor is configured.catalina.sh version.Upgrade to 11.0.23 · 10.1.56 · 9.0.119
11.0.2310.1.569.0.119This page as .md · .json · in your agent: get_signal("CVE-2026-55955") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.