CVE-2026-59084

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.23 Apache Tomcat versions 10.1.0-M1 through 10.1.56 Apache Tomcat versions 9.0.13 through 9.0.119 Apache Tomcat versions 8.5.38 through 8.5.100 Apache Tomcat versions 7.0.100 through 7.0.109

Description Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor, a component used to encrypt cluster session-replication traffic between nodes. The documentation failed to warn that using non-default algorithms, such as AES/CBC, renders replay protection ineffective. This may lead administrators to deploy the component in a weak configuration under the impression that it is secure.

Recommendations Upgrade to version 11.0.24. Upgrade to version 10.1.57. Upgrade to version 9.0.120. Review the EncryptInterceptor configuration against the updated documentation.