Executive brief
Apache Tomcat, a widely used web server and servlet container, was found to have insufficient documentation regarding the secure configuration of its EncryptInterceptor component. This lack of clarity could lead administrators to inadvertently deploy the software with weak security settings, potentially exposing sensitive data transmitted within a Tomcat cluster. Organizations should update to the latest versions to ensure they have access to the corrected configuration guidance.
Technical details
This vulnerability is classified as CWE-1059 (Insufficient Technical Documentation) within the Apache Tomcat EncryptInterceptor. The root cause is a failure to clearly document the specific requirements and parameters necessary to ensure the interceptor provides robust encryption for cluster communication. While not a direct code flaw, the lack of guidance increases the risk of insecure deployments where cryptographic protections might be bypassed or weakened by misconfiguration. The issue affects multiple major versions of Tomcat, and fixes have been released in versions 11.0.24, 10.1.57, and 9.0.120, which include the necessary documentation updates.
Affected products
- Apache Tomcat 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.13 through 9.0.119, 8.5.38 through 8.5.100, 7.0.100 through 7.0.109
Timeline
- 2026-07-14: advisory: Initial publication of CVE-2026-59084