Which products and versions are affected by CVE-2022-29885?

Affected: Tomcat (Apache) versions 10.1.0-milestone1, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13, 10.1.0-milestone14, 10.1.0-milestone2, 10.1.0-milestone3; Hospitality Cruise Shipboard Property Management System (Oracle) versions 20.2.1; Debian Linux versions 10.0, 11.0, among others. The full list is in the CVE brief.

Is CVE-2022-29885 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2022-29885 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2022-29885?

Public exploit code is available.

Is there a fix for CVE-2022-29885?

Fixed versions are available, including Tomcat <=8.5.78, Tomcat 10.0.21, Tomcat 8.5.79.

How urgently should CVE-2022-29885 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2022-29885

Q: What is CVE-2022-29885?

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network.

Q: How urgently should CVE-2022-29885 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

HighPublic exploit

Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption

Published May 13, 2022 · Updated Oct 10, 2026 · Also known as BIT-tomcat-2022-29885, DEBIAN-CVE-2022-29885, GHSA-r84p-88g2-2vx2, UBUNTU-CVE-2022-29885

Key Facts

Patch immediately

CVE-2022-29885 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Tomcat (Apache), Hospitality Cruise Shipboard Property Management System (Oracle), Debian Linux and 12 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 73% probability of exploitation in the next 30 days.
Fixed versions are available, including Tomcat <=8.5.78, Tomcat 10.0.21, Tomcat 8.5.79.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

73%

Higher than 99.4% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2022-29885 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

Affected Products

47 affected entries in total

Product	Affected versions	Fixed in
TomcatApache	10.1.0-milestone1, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13, 10.1.0-milestone14, 10.1.0-milestone2, 10.1.0-milestone3	8.5.78
Hospitality Cruise Shipboard Property Management SystemOracle	20.2.1	n/a
Debian LinuxDebian	10.0, 11.0	n/a
tomcat9debian	See advisory	9.0.43-2~deb11u4
tomcat8ubuntu	See advisory	8.5.39-1ubuntu1~18.04.3+esm2

10 more affected products in the full CVE brief

Patched Releases

Tomcat

<=8.5.78, 10.0.21, 8.5.79, 9.0.63

org.apache.tomcat:tomcat

10.0.21, 10.1.0-M15, 8.5.79, 9.0.63

tomcat8

8.0.32-1ubuntu1.13+esm1, 8.5.39-1ubuntu1~18.04.3+esm2, 8.5.81-1.91.amzn1

tomcat8-admin-webapps

8.5.81-1.91.amzn1

tomcat8-docs-webapp

8.5.81-1.91.amzn1

tomcat8-el-3.0-api

8.5.81-1.91.amzn1

tomcat8-javadoc

8.5.81-1.91.amzn1

tomcat8-jsp-2.3-api

8.5.81-1.91.amzn1

tomcat8-lib

8.5.81-1.91.amzn1

tomcat8-log4j

8.5.81-1.91.amzn1

tomcat8-servlet-3.1-api

8.5.81-1.91.amzn1

tomcat8-webapps

8.5.81-1.91.amzn1

tomcat9

9.0.16-3ubuntu0.18.04.2+esm2, 9.0.31-1~deb10u7, 9.0.31-1ubuntu0.6, 9.0.43-2~deb11u4, 9.0.58-1ubuntu0.1+esm2, 9.0.63-1

Timeline

Publicly disclosed
May 13, 2022
Last updated
Oct 10, 2026

Weakness Type

CWE-400 Uncontrolled Resource Consumption
CWE-1112 Incomplete Documentation of Program Execution

References

15 more references in the full CVE brief

FAQ

Common Questions.

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network.
Affected: Tomcat (Apache) versions 10.1.0-milestone1, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13, 10.1.0-milestone14, 10.1.0-milestone2, 10.1.0-milestone3; Hospitality Cruise Shipboard Property Management System (Oracle) versions 20.2.1; Debian Linux versions 10.0, 11.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Tomcat <=8.5.78, Tomcat 10.0.21, Tomcat 8.5.79.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2022-29885 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo