CVE-2026-32990
published 2026-08-25CVE-2026-32990: Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.31%
23.0th percentile
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.50 < 10.1.53 | 10.1.53 |
| apache | tomcat | >= 10.1.53 < 10.1.58 | 10.1.58 |
| apache | tomcat | >= 11.0.15 < 11.0.20 | 11.0.20 |
| apache | tomcat | >= 11.0.20 < 11.0.25 | 11.0.25 |
| apache | tomcat | >= 9.0.113 < 9.0.116 | 9.0.116 |
| apache | tomcat | >= 9.0.115 < 9.0.121 | 9.0.121 |
| apache_software_foundation | apache_tomcat | 10.1.53 – 10.1.57 | — |
| apache_software_foundation | apache_tomcat | 11.0.20 – 11.0.24 | — |
| apache_software_foundation | apache_tomcat | 9.0.115 – 9.0.120 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ghsa9.1CRITICAL
vendor_apache9.1
vendor_redhat9.1CRITICAL
vendor_oracle8.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
vendor_redhat·2026-08-25·CVSS 5.3
CVE-2026-65637 [MEDIUM] CWE-444 Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication (SNI) validation. This could potentially lead to unauthorized access or misrouting of requests.
Statement: This Moderate flaw in Apache Tomcat allows an HTTP/
Red Hat
Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
vendor_redhat·2026-04-09·CVSS 9.1
CVE-2026-32990 [CRITICAL] CWE-184 Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.
Statement: Moderate impact. This improper input validation vulnerability in Apache Tomcat, stemming from an incomplete fix for CVE-2025-66614, affects Red Hat JBoss Web Server and Red Hat Enterprise Linux. An attacker could exploit this flaw to bypass security controls or induce unexpected application behavior.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat P
Oracle
Oracle Oracle Communications Risk Matrix: Platform (GnuTLS) — CVE-2025-32990
vendor_oracle·2026-01-15·CVSS 8.2
CVE-2025-32990 [MEDIUM] Oracle Oracle Communications Risk Matrix: Platform (GnuTLS) — CVE-2025-32990
Oracle Oracle Communications Risk Matrix: Platform (GnuTLS) vulnerability
CVE: CVE-2025-32990
CVSS: 8.2
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Apache
Apache tomcat: CVE-2025-66614
vendor_apache·CVSS 9.1
CVE-2025-66614 Apache tomcat: CVE-2025-66614
Apache tomcat: CVE-2025-66614
CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. This was fixed with commit 021d1f83 . This issue was reported to the Tomcat security team on 13 March 2026. The issue was made public on 9 April 2026. Affects: 11.0.15 to 11.0.19 Note: The issues below were fixed in Apache Tomcat 11.0.19 but the release vote for the 11.0.19 release candidate did not pass. Therefore, although users must download 11.0.20 to obtain a version that includes a fix for these issues, version 11.0.19 is not included in the list of affected versions.
Severity: moderate
Affected versions: 11.0.19
GHSA
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
ghsa_unreviewed·2026-08-26·CVSS 5.3
CVE-2026-65637 [MEDIUM] CWE-20 Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
VulDB
Apache Tomcat up to 9.0.115/10.1.52/11.0.19 input validation
vuldb·2026-04-09·CVSS 9.1
CVE-2026-32990 [CRITICAL] Apache Tomcat up to 9.0.115/10.1.52/11.0.19 input validation
A vulnerability marked as critical has been reported in Apache Tomcat up to 9.0.115/10.1.52/11.0.19. This affects an unknown function. Performing a manipulation results in improper input validation.
This vulnerability is identified as CVE-2026-32990. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Apache Tomcat has an Improper Input Validation vulnerability
ghsa·2026-04-09·CVSS 9.1
CVE-2026-32990 [CRITICAL] CWE-20 Apache Tomcat has an Improper Input Validation vulnerability
Apache Tomcat has an Improper Input Validation vulnerability
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.
This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GHSA
GHSA-8mc5-53m5-3qj2: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614
ghsa_unreviewed·2026-04-09·CVSS 9.1
CVE-2026-32990 [CRITICAL] CWE-20 GHSA-8mc5-53m5-3qj2: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.
This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-65637 Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
bugzilla·2026-08-25·CVSS 5.3
CVE-2026-65637 [MEDIUM] CVE-2026-65637 Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65637 Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Bugzilla
CVE-2026-32990 tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix [fedora-all]
bugzilla·2026-04-10·CVSS 9.1
CVE-2026-32990 [CRITICAL] CVE-2026-32990 tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix [fedora-all]
CVE-2026-32990 tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-32990 Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
bugzilla·2026-04-09·CVSS 9.1
CVE-2026-32990 [CRITICAL] CVE-2026-32990 Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
CVE-2026-32990 Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.
This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
2026-08-25
Published