The advisory concerns CVE-2026-59084, a vulnerability in Apache Tomcat where insufficient technical documentation for the EncryptInterceptor component can cause administrators to deploy it with insecure settings. This vulnerability does not stem from a coding error but from unclear guidance that may lead to weakened security configurations. The update includes RPM packages for tomcat10 in Red Hat Hardened Images. The impact is limited to potential confidentiality and integrity issues if the EncryptInterceptor is misconfigured. Red Hat products using Apache Tomcat, such as Red Hat Enterprise Linux and JBoss Web Server, are affected. The advisory recommends verifying EncryptInterceptor configurations to ensure security best practices are followed. If the component is not in use, no action is required. No explicit patch or fix version is provided, and no exploits are known in the wild.

The impact is low severity and relates to potential confidentiality and integrity compromise due to insecure configurations of the EncryptInterceptor component in Apache Tomcat. There is no direct code vulnerability; the risk arises from insufficient documentation leading to misconfiguration. No availability impact or known exploitation is reported.

Red Hat advises reviewing existing EncryptInterceptor configurations to ensure they meet secure best practices. If the EncryptInterceptor is not actively used, no specific action is required. No explicit patch or update is mandated by the advisory, but the update to tomcat10 RPMs is available. Users should consult Red Hat's official guidance and apply the RPM updates as appropriate.