Loading vulnerability…
Replay attack in Apache Tomcat cluster EncryptionInterceptor
CVE-2026-55955 is an improper-authentication vulnerability in Apache Tomcat's cluster EncryptionInterceptor that permits replay attacks against encrypted cluster communications. Affected versions include 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109. The Tomcat 9 affected range is inconsistently documented as 9.0.13–9.0.18 and 9.0.13–9.0.118; the identified fixed release is 9.0.119.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can replay previously valid cluster communications against the EncryptionInterceptor, undermining protection against reuse of authenticated messages. Specific downstream effects on applications, sessions, confidentiality, or availability are not established.
If you can’t patch tonight, do this now.
Until the upgrade is completed, restrict cluster communication to trusted, authenticated network peers and prevent untrusted parties from capturing or injecting cluster traffic. Monitor cluster communications for duplicate or unexpected messages.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119, depending on the deployed branch, or a subsequent fixed release. For affected Tomcat 7.0 and 8.5 deployments, migrate to a supported, fixed branch; no fixed releases for those branches are identified.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.