Apache Tomcat 9.0.13 < 9.0.120 multiple vulnerabilities

This Tenable plugin (326730) bundles two CVEs fixed in Apache Tomcat 9.0.120. CVE-2026-59083 is the headliner: Tomcat's RewriteValve incorrectly decoded the + character in rewritten URIs as a space (via Java's URLDecoder.decode() instead of Tomcat's own UDecoder.URLDecode()). This mismatch between the rewrite engine and the security-constraint evaluator means a crafted URI containing + could slip past path-based access controls — but *only* when RewriteValve is explicitly configured AND the security constraints depend on URI integrity post-rewrite. Affected range: 9.0.0.M1 through 9.0.119 (also 10.1.x through 10.1.56 and 11.0.x through 11.0.23). CVE-2026-59084 is a documentation gap: the EncryptInterceptor (a Tomcat clustering component) didn't clearly state that AES/GCM/NoPadding is the only non-malleable cipher choice. Affected range for that one: 9.0.13 through 9.0.119.

The vendor severity is wildly inflated. Apache — the people who wrote Tomcat — rated both CVEs as Low. NVD assigned CVE-2026-59083 a CVSS 9.1 Critical vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which models an unauthenticated, zero-click, high-impact network attack. That vector ignores the most important real-world constraint: RewriteValve is not enabled by default. It's an optional component that most Tomcat operators never touch because URL rewriting is typically handled by a reverse proxy (nginx, Apache httpd, HAProxy). Tenable's VPR score of 4.3 (Medium) — their own risk-adjusted metric — already acknowledges this, yet the plugin headline still screams Critical. The 9.1 is mechanical CVSS math disconnected from operational reality.

1. Audit for RewriteValve usage across your fleet — Run a configuration scan for RewriteValve in server.xml, context.xml, and WEB-INF/rewrite.config files. If zero hits, this CVE is not exploitable in your environment — document and close. This is the single highest-value triage action. As a LOW-severity finding, there is no noisgate mitigation SLA; proceed directly to the remediation window.
2. Upgrade to Tomcat 9.0.120+ within the 365-day remediation window — The noisgate remediation SLA for LOW is ≤365 days. Bundle this with your next scheduled Tomcat maintenance cycle. For 10.1.x, upgrade to 10.1.57+; for 11.0.x, upgrade to 11.0.24+.
3. If RewriteValve IS present, review rewrite rules and security constraints — Check whether any <security-constraint> patterns depend on URI path segments that pass through RewriteValve rules. If they do, consider adding application-layer authorization checks (Spring Security, Servlet filters) as defense-in-depth while the upgrade is pending.
4. Ensure a reverse proxy fronts Tomcat — A reverse proxy (nginx, Apache httpd, HAProxy) that normalizes request URIs before forwarding to Tomcat may neutralize the +-encoding trick. Verify your proxy does not pass raw + characters in path segments to the backend.

Run this on each Tomcat host (or remotely via SSH/Ansible). Requires read access to the Tomcat installation directory. Invoke: bash check_cve_2026_59083.sh /opt/tomcat (pass CATALINA_HOME as the first argument). No root required unless Tomcat dirs are root-owned.

#!/usr/bin/env bash
# check_cve_2026_59083.sh — Checks for CVE-2026-59083 / CVE-2026-59084 (Tenable 326730)
# Usage: bash check_cve_2026_59083.sh /path/to/catalina_home
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-}}"

if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — pass CATALINA_HOME as argument or env var"
  exit 2
fi

# Extract Tomcat version
VERSION_SH="$CATALINA_HOME/lib/catalina.jar"
if [[ ! -f "$VERSION_SH" ]]; then
  # Try version.sh fallback
  if [[ -x "$CATALINA_HOME/bin/version.sh" ]]; then
    VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep -oP 'Server number:\s*\K[0-9.]+')
  else
    echo "UNKNOWN — cannot locate catalina.jar or version.sh in $CATALINA_HOME"
    exit 2
  fi
else
  VERSION=$(unzip -p "$VERSION_SH" org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
    | grep -oP 'server\.info=Apache Tomcat/\K[0-9.]+' || true)
fi

if [[ -z "${VERSION:-}" ]]; then
  echo "UNKNOWN — could not determine Tomcat version"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Version comparison function
version_gte() {
  printf '%s\n%s' "$1" "$2" | sort -V | head -n1 | grep -qx "$2"
}

# Check if version is in affected range for 9.0.x
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)

VULNERABLE=false

case "$MAJOR.$MINOR" in
  9.0)
    if version_gte "$VERSION" "9.0.120"; then
      VULNERABLE=false
    else
      VULNERABLE=true
    fi
    ;;
  10.1)
    if version_gte "$VERSION" "10.1.57"; then
      VULNERABLE=false
    else
      VULNERABLE=true
    fi
    ;;
  11.0)
    if version_gte "$VERSION" "11.0.24"; then
      VULNERABLE=false
    else
      VULNERABLE=true
    fi
    ;;
  8.5)
    # 8.5.x is EOL; all 8.5.0-8.5.100 are affected, no fix available
    if version_gte "$VERSION" "8.5.0"; then
      VULNERABLE=true
      echo "WARNING: Tomcat 8.5.x is EOL — no patch available, migration required"
    fi
    ;;
  *)
    echo "UNKNOWN — version $VERSION is outside known affected ranges"
    exit 2
    ;;
esac

# Bonus: check for RewriteValve (the actual prerequisite for CVE-2026-59083)
RW_FOUND=false
for f in "$CATALINA_HOME"/conf/server.xml "$CATALINA_HOME"/conf/context.xml; do
  if [[ -f "$f" ]] && grep -qi 'RewriteValve' "$f" 2>/dev/null; then
    RW_FOUND=true
    echo "NOTE: RewriteValve detected in $f — CVE-2026-59083 is reachable"
  fi
done
# Also check webapps for rewrite.config
find "$CATALINA_HOME/webapps" -name 'rewrite.config' -print 2>/dev/null | while read -r rc; do
  RW_FOUND=true
  echo "NOTE: rewrite.config found at $rc — CVE-2026-59083 is reachable"
done

if [[ "$VULNERABLE" == "true" ]]; then
  if [[ "$RW_FOUND" == "false" ]]; then
    echo "VULNERABLE (version) — but RewriteValve not detected; CVE-2026-59083 is likely not exploitable"
  else
    echo "VULNERABLE — version and RewriteValve configuration both match"
  fi
  exit 1
else
  echo "PATCHED — Tomcat $VERSION is at or above the fix version"
  exit 0
fi

1. Tenable Plugin 326730
2. Apache Tomcat 9.x Security Advisories
3. CVE-2026-59083 oss-security Disclosure
4. CVE-2026-59083 — NVD
5. CVE-2026-59084 — NVD
6. IONIX Threat Center — CVE-2026-59083
7. Penligent Technical Analysis — CVE-2026-59083
8. Tenable CVE-2026-59083