CVE-2022-29885: Apache Tomcat EncryptInterceptor documentation understates DoS risk

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) denial-of-service with no authentication required and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation.

What it is

The documentation for Apache Tomcat's EncryptInterceptor incorrectly claimed it made Tomcat clustering safe to run over an untrusted network. In reality the interceptor provides confidentiality and integrity but does not protect against all risks, particularly denial-of-service. This matters because operators may have deployed clustering over untrusted networks believing it was fully protected.

Impact

An attacker on the network path can cause denial of service against Tomcat clustering traffic; there is no confidentiality or integrity impact per the CVSS vector.

Attack surface

Reachable over the network (AV:N) with no authentication or user interaction required (PR:N, UI:N), but only where Tomcat clustering with EncryptInterceptor is exposed to an untrusted network.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.73474, 99.4th percentile). A public Packet Storm proof-of-concept for Tomcat 10.1 DoS is referenced, indicating exploit code exists.

What to do

• Upgrade Tomcat to a release where the EncryptInterceptor documentation is corrected (beyond 10.1.0-M14, 10.0.20, 9.0.62, 8.5.78) and apply vendor patches referenced by Oracle and Debian advisories.
• Do not expose Tomcat clustering ports to untrusted networks; restrict them with firewall rules or network segmentation.
• Apply rate limiting and connection controls on clustering endpoints to blunt resource-exhaustion attempts.
• Review the Apache Tomcat mailing list mitigation guidance and adjust deployment assumptions about EncryptInterceptor accordingly.

Detection

• Monitor clustering port traffic for abnormal connection or packet volumes indicative of resource exhaustion.
• Alert on Tomcat process resource spikes (CPU, memory, thread counts) correlated with clustering traffic.
• Audit network exposure of Tomcat clustering ports to confirm they are not reachable from untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.