---
id: "CVE-2026-65637"
kind: "vulnerability"
aliases: ["CVE-2026-65637", "GHSA-f525-44xv-f2qj"]
title: "Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation"
severity: "critical"
cvss: 9.8
epss: 0.00612
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.tomcat:tomcat-coyote", "fixed": ["11.0.25"], "affected": ">= 11.0.20, < 11.0.25", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote", "fixed": ["10.1.59"], "affected": ">= 10.1.53, <= 10.1.57", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote", "fixed": ["9.0.121"], "affected": ">= 9.0.115, < 9.0.121", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["11.0.25"], "affected": ">= 11.0.20, < 11.0.25", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["10.1.59"], "affected": ">= 10.1.53, <= 10.1.57", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["9.0.121"], "affected": ">= 9.0.115, < 9.0.121", "ecosystem": "maven"}, {"name": "apache tomcat", "fixed": ["9.0.121"], "affected": ">= 9.0.115, < 9.0.121", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.58"], "affected": ">= 10.1.53, < 10.1.58", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.25"], "affected": ">= 11.0.20, < 11.0.25", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-20", "java", "maven", "package", "self-hosted", "tomcat"]
not_affected_if: ["default-config", "http1-only"]
published_at: "2026-08-25T22:17:05+00:00"
first_seen_at: "2026-10-27T14:47:35+00:00"
updated_at: "2026-10-27T15:02:22+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-f525-44xv-f2qj", "first_seen_at": "2026-10-27T14:47:35+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65637", "first_seen_at": "2026-10-27T15:02:22+00:00"}]
---

# Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

Apache Tomcat's HTTP/2 handling does not enforce strict SNI validation when a request has no authority header, an incomplete fix for CVE-2026-32990. The sources do not say what an attacker can reach or read after the bypass.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat:tomcat-coyote affected >= 11.0.20, < 11.0.25 fixed 11.0.25
- maven:org.apache.tomcat:tomcat-coyote affected >= 10.1.53, <= 10.1.57 fixed 10.1.59
- maven:org.apache.tomcat:tomcat-coyote affected >= 9.0.115, < 9.0.121 fixed 9.0.121
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 11.0.20, < 11.0.25 fixed 11.0.25
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 10.1.53, <= 10.1.57 fixed 10.1.59
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 9.0.115, < 9.0.121 fixed 9.0.121
- vendor:apache tomcat affected >= 9.0.115, < 9.0.121 fixed 9.0.121
- vendor:apache tomcat affected >= 10.1.53, < 10.1.58 fixed 10.1.58
- vendor:apache tomcat affected >= 11.0.20, < 11.0.25 fixed 11.0.25

## How to check

- Run `mvn dependency:list | grep tomcat` or inspect the lib directory to find tomcat-coyote or tomcat-embed-core versions
- Confirm the version is between `11.0.20` and `11.0.24`, `10.1.53` and `10.1.57`, or `9.0.115` and `9.0.120`
- Check whether HTTP/2 is enabled on the connector

## Fix

- Upgrade Tomcat 11.x to `11.0.25`
- Upgrade Tomcat 10.1.x to `10.1.59`
- Upgrade Tomcat 9.0.x to `9.0.121`

## Timeline

- 2026-10-27T14:47:35+00:00 ghsa https://github.com/advisories/GHSA-f525-44xv-f2qj
- 2026-10-27T15:02:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65637

## From the sources

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_