CVE-2026-59084
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An insufficient technical documentation vulnerability in Apache Tomcat fails to clearly document the requirements for securely configuring the EncryptInterceptor. This affects multiple Tomcat versions from 7.0.100 through 11.0.23.
Risk Assessment
The organization may unknowingly configure the EncryptInterceptor in an insecure manner, potentially allowing unauthorized interception or modification of transmitted data.
Recommendation
Upgrade Apache Tomcat to version 11.0.24, 10.1.57, or 9.0.120 immediately, which include improved documentation and mitigate the risk of misconfiguration.
Original NVD description (English source)
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.