CVE-2026-55955

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.22; >= 10.1.0-M1, <= 10.1.55; >= 9.0.13, <= 9.0.118; >= 8.5.38, <= 8.5.100; >= 7.0.100, <= 7.0.109

References

https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/29/24Third Party Advisory

Timeline

Published: Jun 29, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-559566.5Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or CVE-2026-559577.3Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI CVE-2026-559587.5Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag CVE-2026-55966.3A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools CVE-2026-559607.5Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain CVE-2026-559617.5wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signe CVE-2026-559626.5TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a C CVE-2026-559645.3Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign k CVE-2026-559677.5AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming API CVE-2026-559687.5Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. T CVE-2026-559697.5Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache CVE-2026-55976.3A flaw has been found in griptape-ai griptape 0.19.4. This affects an unknown part of the file griptape\tools\computer\tool.py of the compon