CVE-2022-29885 Public exploit EPSS 73.5%

EncryptInterceptor does not provide complete protection on insecure networks

Apache Software Foundation · Apache Tomcat

Summary

The flaw is in the EncryptInterceptor component of Apache Tomcat clustering, whose documentation wrongly claimed it made clustering safe over untrusted networks, when it only provides confidentiality and integrity protection and leaves resource-exhaustion (DoS) risks unaddressed.

Official description · CVE.org

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

Breakdown

26.3 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) appeared 49 days after disclosure. No confirmed exploitation is recorded.

Disclosed12 May 2022day 0
Public exploit codePoC-in-GitHub30 Jun 2022+49 days

7 fixes in tomcat over 2 years. The latest fix listed for tomcat is 11.0.0-M11.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

10.0.7CVE-2021-3303712 Jul 2021
10.0.16CVE-2022-2318127 Jan 2022
10.1.0-M6CVE-2021-4234014 Oct 2021
10.1.0-M14CVE-2021-4398028 Sep 2022
10.1.0-M15CVE-2022-2988512 May 2022
10.1.0-M17CVE-2022-3430523 Jun 2022
11.0.0-M11CVE-2023-4108025 Aug 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-r84p-88g2-2vx2

Upgrade to 10.0.22

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-13934, CVE-2020-13935, +2).

Also affected, despite being newer: 10.1.0-M1 up to 10.1.0-M15.

Set the version to 10.0.22 or later in your pom.xml or build.gradle.

First fixed in 10.0.21 for CVE-2022-29885.

Affected versions, by release line

If you run	Upgrade to
10.1.0-M1 up to 10.1.0-M15	10.1.45first fix for this CVE: 10.1.0-M15
10.0.0-M1 up to 10.0.21	10.0.22first fix for this CVE: 10.0.21
9.0.13 up to 9.0.63	9.0.109first fix for this CVE: 9.0.63
8.5.38 up to 8.5.79 Still affected on this line by CVE-2025-55752 (no fix published).	8.5.82first fix for this CVE: 8.5.79

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 3 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

6 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-5128

Apache Tomcat 10.1 - Denial Of ServiceEDB-51262 · dos · multiple · 2023-04-05

, 31 Oct 2026

73.5%Top 0.53%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.47%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9947 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 NVD exploit link; 2 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses3 pulses 1.4/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total26.3

Record

Published: 12 May 2022
Modified: 8 Oct 2026
: CWE-400 Uncontrolled Resource Consumption
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 3 community threat pulses (AlienVault OTX)

References

Other 4

mailing-list 1

vendor-advisory 1

techniques