The Red Hat security advisory RHSA-2026:36872 updates Red Hat Hardened Images RPMs, including multiple tomcat11 packages, to address two CVEs: CVE-2026-59083 and CVE-2026-59084. CVE-2026-59084 is a low-impact vulnerability in Apache Tomcat caused by insufficient documentation for the EncryptInterceptor component, which may lead to insecure default configurations. This vulnerability does not stem from a direct code defect but from unclear guidance that could cause administrators to deploy insecure settings, potentially compromising confidentiality or integrity of data. The advisory does not specify a patch for the vulnerability but provides updated RPMs for tomcat11. Red Hat recommends verifying EncryptInterceptor configurations and applying the update as appropriate. No CVSS score is provided by Red Hat, and no known exploits exist in the wild.

The impact is low because the vulnerability is due to insufficient documentation rather than a direct code flaw. Misconfiguration of the EncryptInterceptor could potentially weaken security controls, affecting confidentiality and integrity of data processed by Apache Tomcat. However, if the EncryptInterceptor is not used, there is no impact. There are no reports of active exploitation.

Red Hat advises reviewing existing EncryptInterceptor configurations to ensure they follow secure best practices. If the EncryptInterceptor is not in use, no specific action is required. The advisory includes updated tomcat11 RPM packages that should be applied to benefit from bug fixes and enhancements. Patch status is not explicitly confirmed; users should refer to the Red Hat advisory and apply the provided updates accordingly.