EncryptInterceptor does not provide complete protection on insecure networks
Priority HIGH 77CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.73474 99th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.1.0-M15, 10.0.21, 9.0.63 +1Red Hat: 16 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14; Apache Tomcat 10 10.0.0-M1 to 10.0.20; Apache Tomcat 9 9.0.13 to 9.0.62; Apache Tomcat 8.5 8.5.38 to 8.5.78 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 10.1.0-M1 to before 10.1.0-M15 | 10.1.0-M15 | Patch available | GHSA-r84p-88g2-2vx2 |
| — | org.apache.tomcat:tomcat (Maven) | 10.0.0-M1 to before 10.0.21 | 10.0.21 | Patch available | GHSA-r84p-88g2-2vx2 |
| — | org.apache.tomcat:tomcat (Maven) | 9.0.13 to before 9.0.63 | 9.0.63 | Patch available | GHSA-r84p-88g2-2vx2 |
| — | org.apache.tomcat:tomcat (Maven) | 8.5.38 to before 8.5.79 | 8.5.79 | Patch available | GHSA-r84p-88g2-2vx2 |
- Apache Tomcat VendorApache Affected Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14; Apache Tomcat 10 10.0.0-M1 to 10.0.20; Apache Tomcat 9 9.0.13 to 9.0.62; Apache Tomcat 8.5 8.5.38 to 8.5.78 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.0-M15 Fixed in 10.1.0-M15 Patch available GHSA-r84p-88g2-2vx2
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.21 Fixed in 10.0.21 Patch available GHSA-r84p-88g2-2vx2
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.13 to before 9.0.63 Fixed in 9.0.63 Patch available GHSA-r84p-88g2-2vx2
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.38 to before 8.5.79 Fixed in 8.5.79 Patch available GHSA-r84p-88g2-2vx2
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 8.5.38 – 8.5.78; 9.0.13 – 9.0.62; 10.0.0 – 10.0.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* | 10.1.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:* | 10.1.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:* | 10.1.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:* | 10.1.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:* | 10.1.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:* | 10.1.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* | 10.1.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* | 10.1.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* | 10.1.0 milestone4 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.38 – 8.5.78; 9.0.13 – 9.0.62; 10.0.0 – 10.0.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* Versions 10.1.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:* Versions 10.1.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:* Versions 10.1.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:* Versions 10.1.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:* Versions 10.1.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:* Versions 10.1.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* Versions 10.1.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* Versions 10.1.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* Versions 10.1.0 milestone4 Vulnerable ·Apache
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* | 10.1.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:* | 10.1.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:* | 10.1.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:* | 10.1.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:* | 10.1.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.2.1:*:*:*:*:*:*:* | 20.2.1 | Vulnerable | Oracle |
- cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* Versions 10.1.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:* Versions 10.1.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:* Versions 10.1.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:* Versions 10.1.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:* Versions 10.1.0 milestone9 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.2.1:*:*:*:*:*:*:* Versions 20.2.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-r84p-88g2-2vx2 org.apache.tomcat:tomcat (Maven) Fixed in 10.1.0-M15 Advisory →
- Fix · GHSA-r84p-88g2-2vx2 org.apache.tomcat:tomcat (Maven) Fixed in 10.0.21 Advisory →
- Fix · GHSA-r84p-88g2-2vx2 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.63 Advisory →
- Fix · GHSA-r84p-88g2-2vx2 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.79 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Web Server 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat support for Spring Boot | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat JBoss Web Server 6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-29885
- 2026-10-03 Alias added: GHSA-r84p-88g2-2vx2
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 5
Other 7
- http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
- https://github.com/apache/tomcat/commit/0fa7721f11d565a2cd2e44366c388ad6a3e6357d
- https://github.com/apache/tomcat/commit/36826ea638457d7e17876a70f89cb435b6db0d91
- https://github.com/apache/tomcat/commit/b679bc627f5a4ea6510af95adfb7476b07eba890
- https://github.com/apache/tomcat/commit/eaafd28296c54d983e28a47953c1f5cb2c334f48
- https://github.com/apache/tomcat
- https://security.netapp.com/advisory/ntap-20220629-0002
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2022-29885 · CVE Program
- CVE-2022-29885 · NVD
- FIRST EPSS
- GHSA-r84p-88g2-2vx2 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-29885 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences