ghsa-c5ph-rghf-fjfj
CVSS 6.5 osv_maven
Description
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.118, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-55955
- https://github.com/apache/tomcat/commit/3a9ff01d2dfaca651edacbda3260e37b98b540d3
- https://github.com/apache/tomcat/commit/5e594400c7f6ac0eaf2526bd64442a70f5ccaace
- https://github.com/apache/tomcat/commit/6a7a432cd7fb4ef358dc12e8da99cf3ab320f3fe
- https://github.com/apache/tomcat
- https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- http://www.openwall.com/lists/oss-security/2026/06/29/24
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.23"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.56"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.13"
},
{
"fixed": "9.0.119"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.38"
},
{
"last_affected": "8.5.100"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.100",
"8.5.38",
"8.5.39",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.100"
},
{
"last_affected": "7.0.109"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-tribes",
"purl": "pkg:maven/org.apache.tomcat/tomcat-tribes"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.23"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-tribes",
"purl": "pkg:maven/org.apache.tomcat/tomcat-tribes"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.56"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-tribes",
"purl": "pkg:maven/org.apache.tomcat/tomcat-tribes"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.13"
},
{
"fixed": "9.0.119"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-tribes",
"purl": "pkg:maven/org.apache.tomcat/tomcat-tribes"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.38"
},
{
"last_affected": "8.5.100"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.100",
"8.5.38",
"8.5.39",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-tribes",
"purl": "pkg:maven/org.apache.tomcat/tomcat-tribes"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.100"
},
{
"last_affected": "7.0.109"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109"
]
}
],
"aliases": [
"BIT-tomcat-2026-55955",
"CVE-2026-55955"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2026-11-04T16:35:29Z",
"nvd_published_at": "2026-06-29T21:16:45Z",
"severity": "MODERATE"
},
"details": "Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.118, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.",
"id": "GHSA-c5ph-rghf-fjfj",
"modified": "2026-11-04T16:55:34.284151455Z",
"published": "2026-06-29T21:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55955"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/3a9ff01d2dfaca651edacbda3260e37b98b540d3"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/5e594400c7f6ac0eaf2526bd64442a70f5ccaace"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/6a7a432cd7fb4ef358dc12e8da99cf3ab320f3fe"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-10.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-11.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/29/24"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Tomcat has an Improper Authentication vulnerability"
}