Skip to main content

Apache Tomcat CVE-2026-65637

| EUVDEUVD-2026-66127 CRITICAL
Improper Input Validation (CWE-20)
2026-08-25 security@apache.org GHSA-f525-44xv-f2qj
Apache Information Disclosure Red Hat Tomcat Suse
Critical
Disputed · 9.8 Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify exposed vulnerable Tomcat version
  2. Delivery
    Craft input bypassing incomplete validation
  3. Exploit
    Send request to affected handler
  4. Execution
    Trigger improper input validation flaw
  5. Impact
    Disclose sensitive data or compromise system

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

The target must run one of the specific vulnerable builds - Apache Tomcat 11.0.20-11.0.24, 10.1.53-10.1.57, or 9.0.115-9.0.120 - and expose the connector handling the vulnerable input path to the attacker over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions: remote unauthenticated exploitation with no user interaction against affected versions. The chief limiting factors are version-specificity (builds at or above 9.0.121/10.1.58/11.0.25 are not affected) and network reachability of the vulnerable endpoint; the precise malformed-input trigger is not disclosed in available data, so the exact feature or request type required cannot be named with confidence.
Impact

Signals conflict and should be weighed carefully. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) portrays a trivially exploitable, unauthenticated, remote full-compromise bug - the highest urgency tier on paper. However, EPSS is only 0.21% (11th percentile), there is no CISA KEV listing and no public exploit, and the vendor's own tag reads 'Information Disclosure,' which is inconsistent with the C:H/I:H/A:H triad claimed by the vector. This discrepancy - high-CVSS versus a disclosure-only tag and low EPSS - suggests the real-world impact may be narrower (confidentiality-leaning) than a 9.8 implies; verify the concrete impact against the Apache advisory before treating it as full RCE. Given Tomcat's ubiquity, patching remains a priority regardless, but the absence of exploitation evidence argues for prompt-but-scheduled remediation rather than emergency response.
Exploit ScenarioDerived

A remote attacker sends a crafted request containing input that bypasses the incomplete validation from the prior CVE-2026-32990 fix, reaching the vulnerable handler on an internet-exposed Tomcat instance. Per the CVSS vector this requires no authentication and no user interaction and has low attack complexity, though no public proof-of-concept has been identified to date. The disclosed outcome ranges from sensitive information disclosure (per vendor tagging) up to broader compromise (per the CVSS impact metrics).
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 26, 2026

Improper input validation in Apache Tomcat 9.0.115-9.0.120, 10.1.53-10.1.57, and 11.0.20-11.0.24 stems from an incomplete fix for CVE-2026-32990 and, per its CVSS:3.1 vector, permits remote unauthenticated attackers to compromise confidentiality, integrity, and availability of the servlet container. Reported by the Apache security team, it carries a critical 9.8 base score, though vendor tagging labels the impact as Information Disclosure, which is narrower than the vector implies. No public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.21% (11th percentile).

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121, each of which completes the fix that CVE-2026-32990's remediation left incomplete. Apply the upgrade matching your branch; the vendor describes no in-place mitigation, so patching is the primary control. As compensating measures until the upgrade is deployed, restrict network exposure of the affected Tomcat connector to trusted networks or place it behind a reverse proxy/WAF that normalizes and rejects malformed requests - with the trade-off that a WAF cannot reliably block an undisclosed input-validation flaw and may cause false positives on legitimate traffic. Consult https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj and https://seclists.org/oss-sec/2026/q3/581 for definitive fix guidance.

Affected VersionsENISA

Apache Tomcat 11.0.20 ≤11.0.24
Apache Tomcat 9.0.115 ≤9.0.120
Apache Tomcat 10.1.53 ≤10.1.57

Affected Packages

euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache Tomcat is a widely deployed open-source Java servlet container and web server implementing the Jakarta Servlet, JSP, and WebSocket specifications. The root cause is CWE-20 (Improper Input Validation): a prior remediation for CVE-2026-32990 failed to fully constrain or sanitize a class of input, leaving a residual code path exploitable. Because it is an incomplete-fix regression, the underlying weakness lives in the same request/input-handling component patched previously; the exact malformed input class is not disclosed in the available advisory text. Affected code spans three concurrently maintained branches (9.0.x, 10.1.x, 11.0.x), indicating a shared parsing/validation routine common to all supported lines.

Know when Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (apache) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

Network-reachable, unauthenticated, low-complexity per the input vector, but the vendor 'Information Disclosure' tag and undisclosed impact argue for C:H with I/A set to N pending confirmation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Aug 26, 2026 - 16:22 NVD
9.8 (CRITICAL)
CVE Published
Aug 25, 2026 - 22:17 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 25, 2026 - 22:17 cve.org
CRITICAL 9.8

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive ViewAI

Why It Matters

Apache Tomcat versions 9.0.115-9.0.120, 10.1.53-10.1.57, and 11.0.20-11.0.24 contain a critical input validation vulnerability that allows unauthenticated attackers to fully compromise system confidentiality, integrity, and availability. This is a regression from a prior patch (CVE-2026-32990), meaning organizations previously addressed this risk but remain exposed through incomplete remediation. With no vendor patch currently available and no public exploit identified at time of analysis, the critical severity and unauthenticated attack vector still demand immediate compensating controls.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network-level access to Tomcat services using firewall rules and network segmentation; deploy Web Application Firewall (WAF) with input validation rules to block attack patterns; implement enhanced logging and real-time monitoring for exploitation indicators; consider reverse proxy deployment with input filtering layer; evaluate safe disabling of vulnerable components if identified; establish daily monitoring of Apache security advisories with pre-staged rapid patch deployment procedures.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
High
core Java servlet container in most enterprise web deployments
Social Media
1
Sightings
Data Quality
5 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2018-11784 MEDIUM POC
4.3 Oct 04

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r
CVE-2022-29885 HIGH POC
7.5 May 12

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78

CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-65637 ADVISORY https://seclists.org/oss-sec/2026/q3/581 ADVISORY https://vuldb.com/vuln/395352 REF https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy