CVE-2022-29885

CVE-2022-29885 该工具仅用于安全研究。禁止使用该工具发起非法攻击，使用者应对后果负责 工具仅用于安全研究以及内部自查，禁止使用工具发起非法攻击，造成的后果使用者负责 介绍 Apache Tomcat DoS CVE-2022-29885 漏洞利用 EncryptInterceptor（Tomcat 集群）中的拒绝服务 目标机器需要启动 Cluster Nio Receiver，发送特制的 TCP 数据包会导致目标拒绝服务。无论是否使用 EncryptInterceptor，都存在拒绝服务漏洞的可能性 条件：启用 Tomcat 集群功能，并使用 NioReceiver 进行通...

CVE-2026-34486

CVE-2026-34486 Apache Tomcat Tribes クラスタリングにおける EncryptInterceptor のフェイルオープンバイパスにより、Java デシリアライゼーションを介した未認証 RCE に至る脆弱性。 影響を受けるバージョン: 11.0.19+、10.1.53+、9.0.116+。 修正済みバージョン: 11.0.21、10.1.54、9.0.117。 Bartlomiej Dmitruk striga.ai によって発見・報告されました。 解説: https://striga.ai/research/tomcat-tribes-unauth-rce...

CVE-2022-29885

CVE-2022-29885 by 1vere$k Apache Tomcat DoS CVE-2022-29885 Exploit. Denial of Service in EncryptInterceptor Tomcat Cluster. The target machine needs to start the Cluster Nio Receiver. Sending a special TCP packet will cause a Denial of Service to the target. Whether EncryptInterceptor is used or...

CVE-2020-9484

このツールはセキュリティ研究および内部調査のみに使用してください。不正な攻撃に使用することは禁止されており、使用した場合の結果は利用者が負うものとします。 このツールはセキュリティ研究および内部調査のみに使用してください。不正な攻撃に使用することは禁止されており、使用した場合の結果は利用者が負うものとします。 このツールはセキュリティ研究および内部調査のみに使用してください。不正な攻撃に使用することは禁止されており、使用した場合の結果は利用者が負うものとします。 スクリプトは...

cve-2026-34486-tomcat_encrypt_bypass_reproduction

CVE-2026-34486: Apache Tomcat EncryptInterceptor バイパス...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

CVE-2026-34486-poc

CVE-2026-34486 Apache Tomcat EncryptInterceptor バイパス脆弱性の再現 一、脆弱性の概要...

CVE-2026-34486

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apache Tomcat の Tribes クラスタ通信モジュールは、EncryptInterceptor の復号化に失敗した際にメッセージを破棄せず、認証されていない攻撃者がポート 4000 で Java デシリアライゼーションを介してリモートコード実行 を引き起こすことを可能にします。 脆弱性の詳細...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Apache Tomcat Tribes クラスタリングにおける EncryptInterceptor の fail-open バイパスにより、Java デシリアライゼーションを介した認証不要の RCE に繋がります。 影響を受けるバージョン: 11.0.19+, 10.1.53+, 9.0.116+。 修正版: 11.0.21, 10.1.54, 9.0.117。 Bartlomiej Dmitruk 氏によって発見・報告されました striga.ai。 解説:...

tomcat-cluster-session-sync-exp

도구는 보안 연구 및 내부 자체 점검에만 사용되며, 불법 공격에 사용하는 것을 금지합니다. 발생하는 모든 책임은 사용자에게 있습니다. Tomcat Cluster Sync-Session 익스플로잇 이는 Tomcat이 자체 세션 동기화 기능을 사용할 때 보안 설정이 취약한 경우EncryptInterceptor를 사용하지 않음 발생하는 역직렬화 취약점입니다. 정교하게 조작된 데이터 패킷을 통해 Tomcat의 자체 세션 동기화 기능을 사용하는 서버를 공격할 수 있습니다. 사용법 먼저 JAR 패키지를 컴파일합니다:...

Astra Linux – Vulnerability in Tomcat9

The documentation for Apache Tomcat versions 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62, and 8.5.38 to 8.5.78 states that the EncryptInterceptor enables Tomcat clustering to run over an untrusted network. However, this is incorrect. While the EncryptInterceptor does provide...

Astra Linux – Vulnerability in Tomcat9

The Padding Oracle vulnerability exists in Apache Tomcat’s EncryptInterceptor with the default configuration. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...