CVE-2026-55955 — Apache Tomcat: EncryptInterceptor not protected against replay attacks

Description (CNA)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Tomcat	affected 11.0.0-M1 through 11.0.22; affected 10.1.0-M1 through 10.1.55; affected 9.0.13 through 9.0.118; affected 8.5.38 through 8.5.100; affected 7.0.100 through 7.0.109

CWE

CWE-287

References

https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/29/24

CISA-ADP

No English description supplied.

No references supplied.