Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tomcat:tomcat-tribes

4 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
11.0.27 (Oct 6, 2026): no advisory affects it
Newest unaffected release
11.0.27 (Oct 6, 2026), the latest release
Advisories
4 · 3 high, 1 medium
Dependents
7
Releases
473 since 7.0.0 (Jul 12, 2010)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-55955
    Affects 7.0.100 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.38 to 8.5.100 (9.0.0.M1 is outside it); 9.0.13 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
  • CVE-2026-34487
    Affects 9.0.13 to 9.0.116 (9.0.117 is outside it); 10.1.0-M1 to 10.1.53 (10.1.54 is outside it); 11.0.0-M1 to 11.0.20 (11.0.21 is outside it)
  • CVE-2026-34486
    Affects 9.0.116 (9.0.117 is outside it); 10.1.53 (10.1.54 is outside it); 11.0.20 (11.0.21 is outside it)
  • CVE-2026-29146
    Affects 7.0.100 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.38 to 8.5.100 (9.0.0.M1 is outside it); 9.0.13 to 9.0.115 (9.0.116 is outside it); 10.1.50 to 10.1.52 (10.1.53 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • CVE-2026-55955Medium 6.5

    Apache Tomcat: EncryptInterceptor not protected against replay attacks

    Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.13, fixed in 9.0.119; from 8.5.38, through 8.5.100; from 7.0.100, through 7.0.109.

    Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

    Affected: from 9.0.13, fixed in 9.0.117; from 10.1.0-M1, fixed in 10.1.54; from 11.0.0-M1, fixed in 11.0.21.

    Fixed in 9.0.117 (released Mar 30, 2026, 10 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-34486High 7.5 · KEV

    Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

    Affected: from 11.0.20, fixed in 11.0.21; from 10.1.53, fixed in 10.1.54; from 9.0.116, fixed in 9.0.117.

    Fixed in 9.0.117 (released Mar 30, 2026, 10 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    Affected: from 9.0.13, fixed in 9.0.116; from 10.1.50, fixed in 10.1.53; from 11.0.0-M1, fixed in 11.0.20; from 8.5.38, through 8.5.100; from 7.0.100, through 7.0.109.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.