CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Contournement de type fail-open dans EncryptInterceptor du clustering Apache Tomcat Tribes menant à une RCE non authentifiée via désérialisation Java. Versions concernées : 11.0.19+, 10.1.53+, 9.0.116+. Corrigé dans : 11.0.21, 10.1.54, 9.0.117. Découvert et signalé par Bartlomiej...

tomcat-cluster-session-sync-exp

L'outil est destiné uniquement à la recherche en sécurité et aux audits internes. Il est interdit de l'utiliser pour lancer des attaques illégales. L'utilisateur est responsable des conséquences. Exploit pour tomcat cluster sync-session Il s'agit d'une vulnérabilité de désérialisation existant...

CVE-2020-9484

도구는 보안 연구 및 내부 자체 점검에만 사용해야 하며, 도구를 이용한 불법 공격은 금지됩니다. 이로 인해 발생한 결과는 사용자가 책임집니다. 도구는 보안 연구 및 내부 자체 점검에만 사용해야 하며, 도구를 이용한 불법 공격은 금지됩니다. 이로 인해 발생한 결과는 사용자가 책임집니다. 도구는 보안 연구 및 내부 자체 점검에만 사용해야 하며, 도구를 이용한 불법 공격은 금지됩니다. 이로 인해 발생한 결과는 사용자가 책임집니다. 스크립트는...

CVE-2022-29885

CVE-2022-29885 par 1vere$k Apache Tomcat DoS CVE-2022-29885 Exploit. Déni de service dans EncryptInterceptor Cluster Tomcat. La machine cible doit démarrer le Cluster Nio Receiver. L'envoi d'un paquet TCP spécial provoquera un déni de service sur la cible. Que EncryptInterceptor soit utilisé ou...

CVE-2022-29885

CVE-2022-29885 이 도구는 보안 연구 목적으로만 사용됩니다. 불법 공격을 위해 도구를 사용하는 것을 금지하며, 그로 인한 책임은 사용자에게 있습니다. 工具仅用于安全研究以及内部自查，禁止使用工具发起非法攻击，造成的后果使用者负责 소개 Apache Tomcat DoS CVE-2022-29885 익스플로잇 EncryptInterceptor Tomcat 클러스터에서의 서비스 거부 대상 머신이 Cluster Nio Receiver를 시작해야 합니다. 특수 TCP 패킷을 보내면 대상에 서비스 거부가 발생합니다...

cve-2026-34486-tomcat_encrypt_bypass_reproduction

CVE-2026-34486 : contournement de l'EncryptInterceptor d'Apache Tomcat...

CVE-2026-34486

CVE-2026-34486 Обход fail-open в EncryptInterceptor в кластеризации Apache Tomcat Tribes, приводящий к неаутентифицированному RCE через десериализацию Java. Затронуты: 11.0.19+, 10.1.53+, 9.0.116+. Исправлено в: 11.0.21, 10.1.54, 9.0.117. Обнаружено и сообщено Bartlomiej Dmitruk striga.ai. Статья...

Apache Tomcat 9.0.116 < 9.0.117 Missing Encryption of Sensitive Data Vulnerability (CVE-2026-34486)

The version of Tomcat installed on the remote host is 9.0.116 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146...

OPENSUSE-SU-2026:21490-1 Security update for tomcat11

This update for tomcat11 fixes the following issues - Update to Tomcat 11.0.24 - CVE-2026-59083: Incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements not clearly documented bsc1271398...

VulnCheck KEV: CVE-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the...

CVE-2026-59084

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

Oracle Linux 10 : tomcat (ELSA-2026-36788)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36788 advisory. - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Paddi...

Alibaba Cloud Linux 3 : 0206: tomcat (ALINUX3-SA-2026:0206)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0206 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-29146: Padding Oracle vulnerabili...

BIT-TOMCAT-2026-59084 Apache Tomcat: EncryptInterceptor requirements not clearly documented

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0 through 11.0.23, from 10.1.0 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38...

SUSE CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

MiracleLinux 8 : tomcat-9.0.87-2.el8_10 (AXSA:2026-1262:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1262:04 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache...

Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor

A flaw was found in Apache Tomcat. This Padding Oracle vulnerability, present in the EncryptInterceptor with its default configuration, could allow a remote attacker to decrypt sensitive information. By exploiting weaknesses in the encryption padding, an attacker may be able to gain unauthorized...

DEBIAN-CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

CVE-2026-59084 Apache Tomcat: EncryptInterceptor requirements not clearly documented

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...