CVE-2026-55955

6.5 Moyenne

Publiée le 29/06/2026 à 23:16 · Modifiée le 10/07/2026 à 14:22 · Analysée par le NVD · Source : security@apache.org

Description

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Tomcat
Apache tomcat

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-287

Références

https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106 Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/29/24 Third Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories