Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3440-1 advisory.

    Update to Tomcat 9.0.120:

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass     (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 9.0.120:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI           resource. (markt)
        - Fix: Improve the performance of range validation for the default           servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the           public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from           AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to           provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase           is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but           does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
        - Fix: unintentional conversion of literal + to a space during rule           processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native           is not available when the connector is explicitly configured to use           Tomcat Native with OpenSSL for TLS. (markt)
        - Fix: Correct a regression introduced in 9.0.119 that broke reading of           some request bodies via a Reader. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix           for 69333) was incomplete and tags that threw exceptions in doStartTag()           and doEndTag() were incorrectly re-used. This fix prevents tags from           being re-used if such an exception occurs. (markt)
        - Fix: 70135: Fix security classload regression. (remm)
        - Add: support for specifying Java 28 (with the value 28) as the compiler           source and/or compiler target for JSP compilation. If used with an           Eclipse JDT compiler version that does not support these values, a           warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does           not drop bytes if a compressed message inflates to more than the           available buffer. Fix written by GPT-5.5. Test case written by Hironori           Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during           WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21490-1 advisory.

    This update for tomcat11 fixes the following issues

    - Update to Tomcat 11.0.24
    - CVE-2026-59083: Incorrect URL decoding in RewriteValve may allow security control bypass (bsc#1271397).
    - CVE-2026-59084: EncryptInterceptor requirements not clearly documented (bsc#1271398).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21487-1 advisory.

    Update to Tomcat 10.1.57.

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass     (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 10.1.57:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI           resource. (markt)
        - Fix: Improve the performance of range validation for the default           servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the           public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from           AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to           provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase           is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but           does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
        - Fix: unintentional conversion of literal + to a space during rule           processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native           is not available when the connector is explicitly configured to use           Tomcat Native with OpenSSL for TLS. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix           for 69333) was incomplete and tags that threw exceptions in doStartTag()           and doEndTag() were incorrectly re-used. This fix prevents tags from           being re-used if such an exception occurs. (markt)
        - Fix: 70135: Fix security classload regression. (remm)
        - Add: support for specifying Java 28 (with the value 28) as the compiler           source and/or compiler target for JSP compilation. If used with an           Eclipse JDT compiler version that does not support these values, a           warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does           not drop bytes if a compressed message inflates to more than the           available buffer. Fix written by GPT-5.5. Test case written by Hironori           Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during           WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21486-1 advisory.

    Update to Tomcat 9.0.120.

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass     (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 9.0.120:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI           resource. (markt)
        - Fix: Improve the performance of range validation for the default           servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the           public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from           AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to           provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase           is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but           does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
        - Fix: unintentional conversion of literal + to a space during rule           processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native           is not available when the connector is explicitly configured to use           Tomcat Native with OpenSSL for TLS. (markt)
        - Fix: Correct a regression introduced in 9.0.119 that broke reading of           some request bodies via a Reader. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix           for 69333) was incomplete and tags that threw exceptions in doStartTag()           and doEndTag() were incorrectly re-used. This fix prevents tags from           being re-used if such an exception occurs. (markt)
        - Fix: 70135: Fix security classload regression. (remm)
        - Add: support for specifying Java 28 (with the value 28) as the compiler           source and/or compiler target for JSP compilation. If used with an           Eclipse JDT compiler version that does not support these values, a           warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does           not drop bytes if a compressed message inflates to more than the           available buffer. Fix written by GPT-5.5. Test case written by Hironori           Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during           WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3418-1 advisory.

    Update to Tomcat 10.1.57.

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass     (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 10.1.57:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI           resource. (markt)
        - Fix: Improve the performance of range validation for the default           servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the           public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from           AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to           provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase           is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but           does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
          (remm)
        - Fix: unintentional conversion of literal + to a space during rule           processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native           is not available when the connector is explicitly configured to use           Tomcat Native with OpenSSL for TLS. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix           for 69333) was incomplete and tags that threw exceptions in doStartTag()           and doEndTag() were incorrectly re-used. This fix prevents tags from           being re-used if such an exception occurs. (markt)
        - Fix: 70135: Fix security classload regression. (remm)
        - Add: support for specifying Java 28 (with the value 28) as the compiler           source and/or compiler target for JSP compilation. If used with an           Eclipse JDT compiler version that does not support these values, a           warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does           not drop bytes if a compressed message inflates to more than the           available buffer. Fix written by GPT-5.5. Test case written by Hironori           Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during           WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3419-1 advisory.

    Update to Tomcat 9.0.120.

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass     (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 9.0.120:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI           resource. (markt)
        - Fix: Improve the performance of range validation for the default           servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the           public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from           AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to           provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase           is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but           does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
        - Fix: unintentional conversion of literal + to a space during rule           processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native           is not available when the connector is explicitly configured to use           Tomcat Native with OpenSSL for TLS. (markt)
        - Fix: Correct a regression introduced in 9.0.119 that broke reading of           some request bodies via a Reader. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix           for 69333) was incomplete and tags that threw exceptions in doStartTag()           and doEndTag() were incorrectly re-used. This fix prevents tags from           being re-used if such an exception occurs. (markt)
        - Fix: 70135: Fix security classload regression. (remm)
        - Add: support for specifying Java 28 (with the value 28) as the compiler           source and/or compiler target for JSP compilation. If used with an           Eclipse JDT compiler version that does not support these values, a           warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does           not drop bytes if a compressed message inflates to more than the           available buffer. Fix written by GPT-5.5. Test case written by Hironori           Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during           WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3430-1 advisory.

    Update to Tomcat 11.0.24.

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass     (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 11.0.24:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI           resource. (markt)
        - Fix: Improve the performance of range validation for the default           servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the           public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from           AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to           provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase           is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but           does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
        - Fix: unintentional conversion of literal + to a space during rule           processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native           is not available when the connector is explicitly configured to use           Tomcat Native with OpenSSL for TLS. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix           for 69333) was incomplete and tags that threw exceptions in doStartTag()           and doEndTag() were incorrectly re-used. This fix prevents tags from           being re-used if such an exception occurs. (markt)
        - Add: support for specifying Java 28 (with the value 28) as the compiler           source and/or compiler target for JSP compilation. If used with an           Eclipse JDT compiler version that does not support these values, a           warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does           not drop bytes if a compressed message inflates to more than the           available buffer. Fix written by GPT-5.5. Test case written by Hironori           Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during           WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: to the Eclipse JDT compiler 4.40. (markt)
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1946 advisory.

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-50229)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
    (CVE-2026-53434)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
    (CVE-2026-55955)

    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-55956)

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
    (CVE-2026-59083)

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 9.0.120-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-027 advisory.

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-50229)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
    (CVE-2026-53434)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
    (CVE-2026-55955)

    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-55956)

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
    (CVE-2026-59083)

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1945 advisory.

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-50229)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
    (CVE-2026-53434)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
    (CVE-2026-55955)

    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-55956)

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
    (CVE-2026-59083)

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.120, 10.1.0-M1 prior to 10.1.57 or 11.0.0-M1 prior to 11.0.24. It is, therefore, affected by multiple vulnerabilities :

- The requirements to securely configure the EncryptInterceptor were not clearly documented. (CVE-2026-59084)

- Incorrect decoding of '+' in rewritten URIs to a single space could allow security control bypass for some configurations. (CVE-2026-59083)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38     through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tomcat installed on the remote host is prior to 11.0.24. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.24_security-11 advisory.

  - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38     through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

  - Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1     through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through     8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to     upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue. (CVE-2026-59083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.57. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.57_security-10 advisory.

  - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38     through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

  - Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1     through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through     8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to     upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue. (CVE-2026-59083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.120. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.120_security-9 advisory.

  - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38     through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

  - Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1     through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through     8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to     upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue. (CVE-2026-59083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
331852	SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:3440-1)	Nessus	SuSE Local Security Checks	critical
331572	openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21490-1)	Nessus	SuSE Local Security Checks	critical
331564	openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21487-1)	Nessus	SuSE Local Security Checks	critical
331553	openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21486-1)	Nessus	SuSE Local Security Checks	critical
331462	SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:3418-1)	Nessus	SuSE Local Security Checks	critical
331458	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:3419-1)	Nessus	SuSE Local Security Checks	critical
331434	SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:3430-1)	Nessus	SuSE Local Security Checks	critical
328508	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-1946)	Nessus	Amazon Linux Local Security Checks	critical
328500	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-027 (ALASTOMCAT9-2026-027)	Nessus	Amazon Linux Local Security Checks	critical
328483	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1945)	Nessus	Amazon Linux Local Security Checks	critical
115305	Apache Tomcat 9.0.0-M1 < 9.0.120 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115304	Apache Tomcat 10.1.0-M1 < 10.1.57 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115303	Apache Tomcat 11.0.0-M1 < 11.0.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
327132	Linux Distros Unpatched Vulnerability : CVE-2026-59084	Nessus	Misc.	critical
326732	Apache Tomcat 11.0.0.M1 < 11.0.24 multiple vulnerabilities	Nessus	Web Servers	critical
326731	Apache Tomcat 10.1.0.M1 < 10.1.57 multiple vulnerabilities	Nessus	Web Servers	critical
326730	Apache Tomcat 9.0.13 < 9.0.120 multiple vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2026-59084

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical