Live › vulnerability › CVE-2026-65637
Go to dashboardApache Tomcat's HTTP/2 handling does not enforce strict SNI validation when a request has no authority header, an incomplete fix for CVE-2026-32990. The sources do not say what an attacker can reach or read after the bypass.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:47 UTC, 0h before NVD. All times on this page are UTC.
Servers running Apache Tomcat 9.0.115 to 9.0.120, 10.1.53 to 10.1.57, or 11.0.20 to 11.0.24 that accept HTTP/2 connections are in scope. Applications that use Tomcat only behind a proxy speaking HTTP/1.1, or that do not enable HTTP/2 on the connector, are likely less exposed, but the sources do not confirm this. Teams on the listed fixed versions can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.tomcat:tomcat-coyote | maven | >= 11.0.20, < 11.0.25 | 11.0.25 |
| org.apache.tomcat:tomcat-coyote | maven | >= 10.1.53, <= 10.1.57 | 10.1.59 |
| org.apache.tomcat:tomcat-coyote | maven | >= 9.0.115, < 9.0.121 | 9.0.121 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 11.0.20, < 11.0.25 | 11.0.25 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 10.1.53, <= 10.1.57 | 10.1.59 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 9.0.115, < 9.0.121 | 9.0.121 |
| apache tomcat | vendor | >= 9.0.115, < 9.0.121 | 9.0.121 |
| apache tomcat | vendor | >= 10.1.53, < 10.1.58 | 10.1.58 |
| apache tomcat | vendor | >= 11.0.20, < 11.0.25 | 11.0.25 |
mvn dependency:list | grep tomcat or inspect the lib directory to find tomcat-coyote or tomcat-embed-core versions11.0.20 and 11.0.24, 10.1.53 and 10.1.57, or 9.0.115 and 9.0.12011.0.2510.1.599.0.121Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-65637")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.