CVE-2026-59084Disclosure(apache / tomcat)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache tomcat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-1059

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tomcat

Threat summary

Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 2d ago at 3 mentions (2026-07-14); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

apache

Products

tomcat

Deep dive

Activity timeline6 mentions / 3d

Signal classification3 categories

Disclosure

233.3%

General

233.3%

Patch

233.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	3	Disclosure1General2
2026-07-16	2	Patch2
2026-07-18	1	Disclosure1

Full discourse6 posts

JFrog Security@JFrogSecurity89d
Patch
🚨Since when does a documentation improvement become a Critical vulnerability? Apparently, CVE-2026-59084. Apache Tomcat's EncryptInterceptor docs didn't warn that non-default algorithms like AES/CBC leave replay protection ineffective. The fix? Updated documentation. Zero lines of code changed. CISA rated it 9.1 Critical. Apache rated it Low. JFrog's analysis agrees with Apache.
Post summary
The vulnerability involves ineffective replay protection when non‑default algorithms are used, but the only fix is a documentation update with no code changes, highlighting a disparity between CISA and vendor severity ratings.
1602262.8K
5.6K followersView on X
Nicolas Krassas@Dinosn90d
General
Over exaggerated CVEs are often seen, like https://nvd.nist.gov/vuln/detail/CVE-2026-59084 . Nobody takes the time to think the volume of work that comes with these classifications when you are dealing with vuln management. People submit CVE calculating the risk on their head if this will be ever exploitable. Vendor take the CVE as is and applied on tools, next day scanner shows 1k critical and you are thinking is everything compromised?
Post summary
The text critiques the perceived over‑exaggeration of CVEs, particularly CVE-2026-59084, without providing evidence of exploitation, patches, or technical details, positioning it as a general commentary on vulnerability management practices.
1201433.2K
160.8K followersView on X
Open Source Security mailing list@oss_security87d
Disclosure
CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass https://www.openwall.com/lists/oss-security/2026/07/14/7 CVE-2026-59084: Apache Tomcat: EncryptInterceptor requirements not clearly documented https://www.openwall.com/lists/oss-security/2026/07/14/8
Post summary
The post announces two Apache Tomcat CVEs, outlining technical issues but providing no evidence of exploitation, PoC, or patches.
00011641
4.7K followersView on X
Upwind Security MDR@UpwindMDR88d
Patch
🚨Critical - Apache Tomcat EncryptInterceptor Documentation Gap (CVE-2026-59084) Apache Tomcat did not clearly document the requirements to securely configure the EncryptInterceptor, the component that encrypts cluster session-replication traffic between nodes. As a result, administrators could deploy it in a weak configuration while believing it was secure. This is a documentation-class issue (CWE-1059), not a directly exploitable code flaw, and it only matters if you run Tomcat clustering with the EncryptInterceptor. NVD has not assigned a CVSS score. 👉Upgrade to Apache Tomcat 11.0.24, 10.1.57, or 9.0.120, and review your EncryptInterceptor configuration against the updated docs.
Post summary
The post highlights a documentation gap in Apache Tomcat’s EncryptInterceptor, emphasizes upgrading to mitigated versions, and clarifies the issue is not directly exploitable.
0000087
254 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-59084 Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. … https://www.cve.org/CVERecord?id=CVE-2026-59084 ----- Traducción: CVE-2026-59084 Vul… http://infoflow.cloud`
Post summary
The text announces the newly disclosed CVE-2026-59084, noting insufficient technical documentation for securely configuring the EncryptInterceptor in Apache Tomcat.
0000051
92 followersView on X
CVE@CVEnew91d
General
CVE-2026-59084 Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. … https://www.cve.org/CVERecord?id=CVE-2026-59084
Post summary
The excerpt merely announces CVE-2026-59084, noting inadequate documentation for Apache Tomcat’s EncryptInterceptor, with no additional details on exploitation, patches, or technical specifics.
00000620
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	tomcat	-	-	-

Explore more

Back to dashboard apache CVEs tomcat vulnerabilities

What researchers are saying

CVE-2026-59084

JFrog Security[verified]@JFrogSecurityPatch

The vulnerability involves ineffective replay protection when non‑default algorithms are used, but the only fix is a documentation update with no code changes, highlighting a disparity between CISA and vendor severity ratings.

Nicolas Krassas[verified]@DinosnGeneral

The text critiques the perceived over‑exaggeration of CVEs, particularly CVE-2026-59084, without providing evidence of exploitation, patches, or technical details, positioning it as a general commentary on vulnerability management practices.

Upwind Security MDR[verified]@UpwindMDRPatch

The post highlights a documentation gap in Apache Tomcat’s EncryptInterceptor, emphasizes upgrading to mitigated versions, and clarifies the issue is not directly exploitable.

Open Source Security mailing list@oss_securityDisclosure

The post announces two Apache Tomcat CVEs, outlining technical issues but providing no evidence of exploitation, PoC, or patches.

Infoflowcloud@infoflowcloudDisclosure

The text announces the newly disclosed CVE-2026-59084, noting insufficient technical documentation for securely configuring the EncryptInterceptor in Apache Tomcat.

CVE@CVEnewGeneral

The excerpt merely announces CVE-2026-59084, noting inadequate documentation for Apache Tomcat’s EncryptInterceptor, with no additional details on exploitation, patches, or technical specifics.