CVE-2022-29885
EncryptInterceptor does not provide complete protection on insecure networks
- Published
- May 12, 2022
- Updated
- Oct 8, 2026
- Assigning CNA
- apache
- Evidence observed
- Apr 5, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HHigh · next 30 days
- Percentile
- 99.5%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Sources
- CVE-2022-29885Exploit
Go-based exploit for Apache Tomcat Denial of Service (CVE-2022-29885) targeting the EncryptInterceptor in Tomcat Cluster NioReceiver. Sends a crafted TCP packet to trigger DoS on any affected Tomcat version.
- CVE-2022-29885Exploit
Apache Tomcat CVE-2022-29885
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.