¡¾Îó²îͨ¸æ¡¿Apache Tomcat EncryptInterceptorÈƹýÎó²î(CVE-2026-34486)

Ðû²¼Ê±¼ä 2026-04-15

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Apache Tomcat EncryptInterceptorÈƹýÎó²î

CVE   ID

CVE-2026-34486

Îó²îÀàÐÍ

ÈÏÖ¤/ÊÚȨ»úÖÆÈƹýÎó²î

·¢Ã÷ʱ¼ä

2026-4-15

Îó²îÆÀ·Ö

7.5

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

δ¹ûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


Apache TomcatÊÇÒ»¸ö¿ªÔ´µÄJava ServletÈÝÆ÷ºÍWebЧÀÍÆ÷£¬£¬£¬£¬Ö÷ÒªÓÃÓÚÔËÐÐJavaÓ¦ÓóÌÐò£¬£¬£¬£¬ÌØÊâÊÇ»ùÓÚServletºÍJava Server PagesÊÖÒÕµÄÓ¦Óᣡ£¡£ËüÓÉApacheÈí¼þ»ù½ð»á¿ª·¢£¬£¬£¬£¬ÆÕ±éÓ¦ÓÃÓÚWeb¿ª·¢ºÍÆóÒµ¼¶Ó¦ÓóÌÐòÖУ¬£¬£¬£¬Ö§³ÖServlet¡¢Java Server PagesÒÔ¼°WebSocketµÈÊÖÒÕ£¬£¬£¬£¬¾ßÓиßÐÔÄÜ¡¢¿ÉÀ©Õ¹ÐԺͿɿ¿ÐÔ¡£¡£¡£


2026Äê4ÔÂ15ÈÕ£¬£¬£¬£¬¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄ£¨VSRC£©¼à²âµ½Apache Tomcat EncryptInterceptorÈƹýÎó²î¡£¡£¡£¸ÃÎó²îÔ´ÓÚ¶ÔCVE-2026-29146µÄÐÞ¸´ÊµÏÖ±£´æÂß¼­È±ÏÝ£¬£¬£¬£¬µ¼ÖÂÓÃÓÚ±£»£»£»£»£»£»£»¤¼¯ÈºÍ¨Ñ¶Çå¾²µÄEncryptInterceptor»úÖƿɱ»Èƹý£¬£¬£¬£¬´Ó¶øʹԭ±¾Ó¦¼ÓÃܵÄÊý¾Ý´«Êäʧȥ±£»£»£»£»£»£»£»¤¡£¡£¡£ÔÚÌض¨Ìõ¼þÏ£¬£¬£¬£¬µ±TomcatÆôÓÃÁËTribes¼¯Èº¹¦Ð§²¢ÉèÖÃEncryptInterceptor×èµ²Æ÷£¬£¬£¬£¬ÇÒ¹¥»÷ÕßÄܹ»»á¼û¼¯ÈºÍ¨Ñ¶¶Ë¿Ú£¨Ä¬ÈÏTCP 4000£©£¬£¬£¬£¬Í¬Ê±Ä¿µÄЧÀÍÆ÷µÄJava ClasspathÖб£´æ¿ÉʹÓõķ´ÐòÁл¯GadgetÁ´Ê±£¬£¬£¬£¬¹¥»÷Õ߿ɽṹ¶ñÒâÊý¾Ý°üÈƹý¼ÓÃÜУÑé²¢×¢Èë¶ñÒâÐòÁл¯Êý¾Ý¡£¡£¡£ÀÖ³ÉʹÓøÃÎó²î¿ÉÄܵ¼ÖÂÃô¸ÐÐÅϢй¶¡¢Í¨Ñ¶±»¸Ä¶¯£¬£¬£¬£¬ÉõÖÁÁ¬Ïµ·´ÐòÁл¯Ê¹ÓÃÁ´ÊµÏÖÔ¶³Ì´úÂëÖ´ÐУ¬£¬£¬£¬½ø¶ø¶ÔϵͳÇå¾²¼°Êý¾ÝºÏ¹æÐÔÔì³ÉÑÏÖØÍþв¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


Apache Tomcat = 11.0.20
Apache Tomcat = 10.1.53
Apache Tomcat = 9.0.116


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´²¹¶¡£¬£¬£¬£¬ÒÔÐÞ¸´¸ÃÎó²î¡£¡£¡£
Apache Tomcat >= 11.0.21
Apache Tomcat >= 10.1.54
Apache Tomcat >= 9.0.117


ÏÂÔØÁ´½Ó£ºhttps://tomcat.apache.org/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£

? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://nvd.nist.gov/vuln/detail/CVE-2026-34486/
https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly/