Bug 2499931 (CVE-2026-59084)

Summary:	CVE-2026-59084 tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	csutherl, dsoumis, jclere, jwon, pjindal, plodge, rhel-process-autobot, rmaucher, szappis, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2508530
Bug Blocks:

Description OSIDB Bzimport 2026-07-14 10:01:39 UTC

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

Comment 5 Jon Orris 2026-09-14 13:35:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:67163 https://access.redhat.com/errata/RHSA-2026:67163

Comment 7 Jon Orris 2026-09-17 14:21:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:68659 https://access.redhat.com/errata/RHSA-2026:68659

Comment 8 Jon Orris 2026-09-17 14:33:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:68678 https://access.redhat.com/errata/RHSA-2026:68678

Comment 9 Jon Orris 2026-09-17 14:36:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:68679 https://access.redhat.com/errata/RHSA-2026:68679

Comment 10 Jon Orris 2026-09-17 14:39:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:68680 https://access.redhat.com/errata/RHSA-2026:68680

Comment 11 Jon Orris 2026-09-17 14:40:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:68660 https://access.redhat.com/errata/RHSA-2026:68660

Comment 12 Jon Orris 2026-09-17 15:03:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:68677 https://access.redhat.com/errata/RHSA-2026:68677

Comment 13 Jon Orris 2026-09-18 09:04:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:68651 https://access.redhat.com/errata/RHSA-2026:68651