CVE-2026-59084

Published Jul 14, 2026

Last updated 9 days ago

CVSS critical 9.1

Overview

Description: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
Source: security@apache.org
NVD status: Analyzed
Products: tomcat

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-1059

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "21FCAD61-9B9D-4780-9EE2-2F28B3F951F5",
            "versionEndIncluding": "7.0.109",
            "versionStartIncluding": "7.0.100",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "769FDDAB-B636-43A6-BB06-CCE9185D5EA6",
            "versionEndIncluding": "8.5.100",
            "versionStartIncluding": "8.5.38",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A332E23F-9A0B-41C6-B00D-8E92BF206791",
            "versionEndIncluding": "9.0.119",
            "versionStartIncluding": "9.0.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1B3DEC2A-7E4A-4851-8466-AFCC4B249748",
            "versionEndIncluding": "10.1.56",
            "versionStartIncluding": "10.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "30943912-13A4-40D8-A9E3-9DE3C0008258",
            "versionEndIncluding": "11.0.23",
            "versionStartIncluding": "11.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References