CVE-2022-29885

CVE-2022-29885 La herramienta se utiliza únicamente para investigación de seguridad. Se prohíbe usar la herramienta para lanzar ataques ilegales, y el usuario es responsable de las consecuencias La herramienta se utiliza únicamente para investigación de seguridad y autocomprobación interna. Se...

CVE-2026-34486

CVE-2026-34486 Bypass de fail-open en EncryptInterceptor en el clustering de Apache Tomcat Tribes que conduce a RCE no autenticado mediante deserialización de Java. Afecta: 11.0.19+, 10.1.53+, 9.0.116+. Corregido en: 11.0.21, 10.1.54, 9.0.117. Encontrado y reportado por Bartlomiej Dmitruk...

CVE-2022-29885

CVE-2022-29885 por 1vere$k Exploit de DoS de Apache Tomcat CVE-2022-29885. Denegación de servicio en EncryptInterceptor Tomcat Cluster. La máquina objetivo necesita iniciar el Cluster Nio Receiver. El envío de un paquete TCP especial provocará una denegación de servicio en el objetivo. Se utilice...

cve-2026-34486-tomcat_encrypt_bypass_reproduction

CVE-2026-34486: Omisión del EncryptInterceptor de Apache Tomcat Campo| Valor ---|--- CVE| CVE-2026-34486 CVSS| 7.5 HIGH Tipo| Falta de cifrado de datos sensibles Componente| Apache Tomcat Cluster EncryptInterceptor Publicado| 2026 Resumen CVE-2026-34486 es una regresión introducida por la...

CVE-2026-34486-poc

CVE-2026-34486 Vulnerabilidad de Omisión de EncryptInterceptor en Apache Tomcat - Reproducción 1. Resumen de la Vulnerabilidad Atributo| Detalles ---|--- ID de CVE| CVE-2026-34486 Gravedad| Importante / Alta CVSS 3.1: 7.5 Tipo de vulnerabilidad| CWE-311 Falta de cifrado de datos sensibles /...

CVE-2026-34486

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apache Tomcat El módulo de comunicación del clúster Tribes no descarta los mensajes cuando falla el descifrado de EncryptInterceptor, lo que permite a atacantes no autenticados desencadenar Ejecución Remota de Código mediante deserialización d...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Derivación de fail-open en EncryptInterceptor en el clustering de Apache Tomcat Tribes que conduce a RCE no autenticado mediante deserialización de Java. Afectados: 11.0.19+, 10.1.53+, 9.0.116+. Corregido en: 11.0.21, 10.1.54, 9.0.117. Descubierto y reportado por Bartlomiej Dmitruk...

tomcat-cluster-session-sync-exp

The tool is only for security research and internal self-inspection. It is prohibited to use the tool for illegal attacks. The user shall bear all consequences. tomcat cluster sync-session exploit This is an exploit targeting deserialization vulnerabilities caused by insecure configurations lack ...

tomcat-cluster-session-sync-exp

La herramienta se utiliza únicamente para investigación de seguridad y autoevaluación interna. Está prohibido usarla para lanzar ataques ilegales; el usuario es responsable de las consecuencias. Exploit de sincronización de sesiones del clúster de Tomcat Este es un exploit de deserialización...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780997466)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780997466 advisory. - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_36790)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636790 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_36879)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636879 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat:...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781108520)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781108520 advisory. - Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat:...

Insufficient Technical Documentation

Apache Tomcat is vulnerable to Insufficient Technical Documentation. The vulnerability is due to insufficient security configuration guidance, which could allow an administrator to deploy Tomcat with an insecure EncryptInterceptor configuration and potentially expose protected cluster communicati...

Multiple Apache Tomcat vulnerabilities

Moderate: Apache Tomcat: Fix for CVE-2025-66614 is incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. Important: Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attac...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...