Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
Summary
| CVE | CVE-2026-65637 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-25 22:17:05 UTC |
| Updated | 2026-08-25 22:17:05 UTC |
| Description | Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue. |
Risk And Classification
Problem Types: CWE-20 | CWE-20 CWE-20 Improper Input Validation
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache Tomcat | affected 11.0.20 11.0.24 semver | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected 10.1.53 10.1.57 semver | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected 9.0.115 9.0.120 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Parag Ambildhuke (https://github.com/paragxa) (en)
There are currently no legacy QID mappings associated with this CVE.