CVE-2026-55955
Public on 2026-06-29
Modified on 2026-07-01
Description
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Tomcat9 Extra | tomcat | 2026-07-20 | ALAS2TOMCAT9-2026-027 | Fixed |
| Amazon Linux 2 - Core | tomcat | Not Affected | ||
| Amazon Linux 2 - Core | tomcat-native | Not Affected | ||
| Amazon Linux 2023 | tomcat-native | Not Affected | ||
| Amazon Linux 2023 | tomcat-taglibs-parent | Not Affected | ||
| Amazon Linux 2023 | tomcat10 | 2026-07-20 | ALAS2023-2026-1946 | Fixed |
| Amazon Linux 2023 | tomcat9 | 2026-07-20 | ALAS2023-2026-1945 | Fixed |
| Amazon Linux 2 - Core | tomcatjss | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |