GitHub Advisoryadvisory · Maven

GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

CRITICAL Published 2026-08-26 Modified 2026-10-27 Official page ↗
Aliases
CVE-2026-65637
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2026-10-27

Affected packages

• Maven org.apache.tomcat:tomcat-coyote: >= 11.0.20, < 11.0.25 → fixed in 11.0.25 • Maven org.apache.tomcat:tomcat-coyote: >= 10.1.53, < 10.1.59 → fixed in 10.1.59 • Maven org.apache.tomcat:tomcat-coyote: >= 9.0.115, < 9.0.121 → fixed in 9.0.121 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.20, < 11.0.25 → fixed in 11.0.25 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.53, < 10.1.59 → fixed in 10.1.59 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.115, < 9.0.121 → fixed in 9.0.121

Description

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.

Related

Alias · CVE (1)

  • CVE-2026-65637 Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References