CVE-2026-55955

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.22 Apache Tomcat versions 10.1.0-M1 through 10.1.55 Apache Tomcat versions 9.0.13 through 9.0.18 Apache Tomcat versions 8.5.38 through 8.5.100 Apache Tomcat versions 7.0.100 through 7.0.109

Description Improper authentication in the cluster component allows a replay attack against the EncryptionInterceptor. A replay attack occurs when a valid data transmission is maliciously or fraudulently repeated or delayed.

Recommendations Upgrade versions 11.0.0-M1 through 11.0.22 to 11.0.23. Upgrade versions 10.1.0-M1 through 10.1.55 to 10.1.56. Upgrade versions 9.0.13 through 9.0.18 to 9.0.119. At the moment, there is no information about a newer version that contains a fix for this vulnerability for versions 8.5.38 through 8.5.100 and 7.0.100 through 7.0.109.