Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-55955 BIT-tomcat-2026-55955EUVD-2026-40231GHSA-c5ph-rghf-fjfj

Apache Tomcat: EncryptInterceptor not protected against replay attacks

Published Jun 29, 2026 · Updated Jun 30, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat Package: org.apache.tomcat:tomcat-tribes Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat11 Package: tomcat6 Package: tomcat7 Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.22, 10.1.0-M1 – ≤ 10.1.55, 9.0.13 – ≤ 9.0.118, 8.5.38 – ≤ 8.5.100, 7.0.100 – ≤ 7.0.109 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.60-1 —
Debian 14 tomcat11 11.0.24-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.60-1~deb13u1 —
Debian 13 tomcat11 No fix yet —
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.60-1~deb12u1 —
Debian 12 tomcat9 9.0.70-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tomcat9 +2 No fix yet —
Ubuntu 26.04 LTS tomcat9 +2 No fix yet —
Ubuntu 25.10 tomcat9 +2 No fix yet —
Ubuntu 24.04 LTS tomcat9 +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat8 +1 No fix yet —
Ubuntu Pro 16.04 LTS tomcat7 +1 No fix yet —
Ubuntu Pro 14.04 LTS tomcat6 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tomcat9 +7 1:9.0.120-1.el10_2 RHSA-2026:68651
RHEL 9 tomcat +7 1:9.0.120-2.el9_8 RHSA-2026:68660
RHEL 8 tomcat +7 1:9.0.120-1.el8_10 RHSA-2026:68677
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS tomcat9 +7 1:9.0.120-1.el10_0 RHSA-2026:67163
RHEL 9.6 EUS tomcat +7 1:9.0.120-1.el9_6 RHSA-2026:68659
RHEL 9.4 E4S tomcat +7 1:9.0.120-1.el9_4 RHSA-2026:68679
RHEL 9.2 E4S tomcat +7 1:9.0.120-1.el9_2 RHSA-2026:68678
RHEL 8.8 TUS tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
RHEL 8.8 E4S tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
Red Hat Hardened Images 1 tomcat10 +9 1:10.1.56-1.hum1 RHSA-2026:29203
Red Hat Hardened Images 1 tomcat11 +9 1:11.0.23-0.1.hum1 RHSA-2026:32960

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat9 +7 1:9.0.120-1.el10_2.alma.1 ALSA-2026:68651
AlmaLinux 9 tomcat +7 1:9.0.120-2.el9_8 ALSA-2026:68660
AlmaLinux 8 tomcat +7 1:9.0.120-1.el8_10 ALSA-2026:68677

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.119-150200.111.1 SUSE-SU-2026:3088-1
SLES 15 SP7 tomcat10 10.1.56-150200.5.70.1 SUSE-SU-2026:3112-1
SLES 15 SP7 tomcat11 11.0.23-150600.13.24.1 SUSE-SU-2026:3087-1
SLES 12 SP5 tomcat 9.0.119-3.169.1 SUSE-SU-2026:3167-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 tomcat 9.0.119-160000.1.1 SUSE-SU-2026:22646-1
SLES for SAP 16.0 tomcat10 10.1.56-160000.1.1 SUSE-SU-2026:22647-1
SLES for SAP 16.0 tomcat11 11.0.23-160000.1.1 SUSE-SU-2026:22648-1
SLES 16.0 tomcat 9.0.119-160000.1.1 SUSE-SU-2026:22646-1
SLES 16.0 tomcat10 10.1.56-160000.1.1 SUSE-SU-2026:22647-1
SLES 16.0 tomcat11 11.0.23-160000.1.1 SUSE-SU-2026:22648-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.119-1.1 openSUSE-SU-2026:11208-1
openSUSE Tumbleweed tomcat10 10.1.56-1.1 openSUSE-SU-2026:11209-1
openSUSE Tumbleweed tomcat11 11.0.23-1.1 openSUSE-SU-2026:11195-1
openSUSE Leap 16.0 tomcat 9.0.119-160000.1.1 openSUSE-SU-2026:21327-1
openSUSE Leap 16.0 tomcat10 10.1.56-160000.1.1 openSUSE-SU-2026:21328-1
openSUSE Leap 16.0 tomcat11 11.0.23-160000.1.1 openSUSE-SU-2026:21329-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.57-1.amzn2023.0.1 ALAS2023-2026-1946
Amazon Linux 2023 tomcat9 +7 1:9.0.120-1.amzn2023.0.1 ALAS2023-2026-1945

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.23 11.0.23 GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.56 10.1.56 GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat >= 9.0.13, < 9.0.119 9.0.119 GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat >= 8.5.38, <= 8.5.100 — GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat >= 7.0.100, <= 7.0.109 — GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat-tribes >= 11.0.0-M1, < 11.0.23 11.0.23 GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat-tribes >= 10.1.0-M1, < 10.1.56 10.1.56 GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat-tribes >= 9.0.13, < 9.0.119 9.0.119 GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat-tribes >= 8.5.38, <= 8.5.100 — GHSA-c5ph-rghf-fjfj
Maven org.apache.tomcat:tomcat-tribes >= 7.0.100, <= 7.0.109 — GHSA-c5ph-rghf-fjfj

Advisories 30

References