Executive brief
Apache Tomcat, a widely used web server and application container, contains a security flaw in its clustering component. This vulnerability allows an attacker to perform a 'replay attack,' where they intercept and resend valid encrypted messages to the server. This could potentially disrupt cluster operations or lead to unauthorized actions within the server environment.
Technical details
An improper authentication vulnerability exists in the Apache Tomcat clustering component's EncryptionInterceptor. The flaw allows for replay attacks because the interceptor does not sufficiently validate the uniqueness or freshness of encrypted messages received from other nodes in the cluster. An attacker with network access to the cluster communication channel could capture and re-inject encrypted packets to trigger unintended actions or state changes. The issue is resolved in versions 11.0.23, 10.1.56, and 9.0.119.
Affected products
- Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.18, 8.5.38 through 8.5.100, 7.0.100 through 7.0.109
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory