The vulnerability arises because Apache Tomcat does not preserve the configured cipher preference order during a TLS handshake. This oversight can cause a client‑selected cipher suite that is weaker than the server’s intended choice, potentially enabling downgrade attacks or exposure of encrypted traffic. Server administrators rely on the specified cipher order to enforce the use of strong cryptographic algorithms; failure to honor the order undermines the confidentiality and integrity guarantees of TLS connections.

The issue affects Apache Tomcat releases 11.0.16 through 11.0.18, 10.1.51 through 10.1.52, and 9.0.114 through 9.0.115. All deployments using one of these affected versions are vulnerable regardless of other configuration settings.

The CVSS score is not provided, but the nature of the flaw allows an attacker to force the use of a weaker cipher suite, which can be exploited to intercept or tamper with SSL/TLS traffic. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a network‑bound TLS connection, where an adversary can supply a handshake that leverages the misorder of cipher suites. Because the flaw is in the server’s handling of cryptographic preferences, the attack does not require privileged access and can be performed remotely against any exposed Tomcat instance.