Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache Tomcat 11: Insecure Session Cookies via Reverse Proxy

published 9 months ago
Summary

Using a reverse proxy with Apache Tomcat 11 can create insecure session cookies. This can allow attackers to hijack user sessions. Update to the latest version of Apache Tomcat to fix this issue.

What to do
  • Update cleanstart tomcat9 to version 9.0.80-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart tomcat9 < 9.0.80-r0
Fix: upgrade to 9.0.80-r0
Original advisory text
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11
Multiple security vulnerabilities affect the tomcat9 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published30 Jan 2026
Updated23 Jun 2026
First seen23 Jun 2026
Sources
CLEANSTART-2026-XI02879 · OSV
Track software like this
Free during beta