Medium [CVE-2026-55955] Replay attack via improper authentication in EncryptionInterceptor
This medium-severity Red Hat Linux advisory covers CVE-2026-55955.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Replay attack via improper authentication in EncryptionInterceptor. Red Hat rates this moderate (CVSS 4.2).
Weakness: CWE-294. Red Hat lists fixing advisory RHSA-2026:29203 with package tomcat11-main-11.0.23-0.1.hum1, tomcat10-main-10.1.56-1.hum1.
- tomcat11-main-11.0.23-0.1.hum1
- tomcat10-main-10.1.56-1.hum1
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- tomcat11-main-11.0.23-0.1.hum1
- tomcat10-main-10.1.56-1.hum1
- RHSA-2026:29203
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- This vulnerability only affects Tomcat deployments using the EncryptionInterceptor for Tribes cluster communication. Deployments that do not use Tomcat clustering or do not configure the EncryptionInterceptor are not affected. Ensure cluster communication channels are restricted to trusted, isolated networks.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.