CVE-2026-65637 Details
Description
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
A vulnerability allowing HTTP/2 no-authority bypass of strict Server Name Indication (SNI) validation has been identified in Apache Tomcat. This issue arises from improper input validation and an incomplete fix for a previous vulnerability (CVE-2026-32990). Affected versions include Apache Tomcat 11.0.20 prior to 11.0.24, 10.1.53 prior to 10.1.57, and 9.0.115 prior to 9.0.120.
Users are advised to upgrade to Apache Tomcat 11.0.25, 10.1.59, or 9.0.121. Additionally, users can remove the examples web application to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj | [email protected] | Vendor AdvisoryMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache tomcat | >= 9.0.115, < 9.0.121 >= 10.1.53, < 10.1.58 >= 11.0.20, < 11.0.25 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 27, 2026 | Initial Analysis | [email protected] |
| Aug 26, 2026 | CVE Modified | [email protected] |
| Aug 26, 2026 | CVE Modified | CISA-ADP |
| Aug 25, 2026 | New CVE Received | [email protected] |