Encryption Bypasses and Kubernetes Token Leaks Hit Apache Tomcat

Apache Tomcat has ten disclosed vulnerabilities across multiple branches (8.5, 9.0, 10.1, 11.0) that include high-impact cryptographic issues (a padding oracle and an EncryptInterceptor bypass), OCSP/client-cert soft-fail logic, exposure of Kubernetes bearer tokens in logs, HTTP request smuggling, open redirect, and JSON logging escape; administrators are advised to upgrade immediately (and update Tomcat Native) to remediate these issues.