CVE-2026-32990CWE-20

Apache Tomcat: Fix for CVE-2025-66614 is incomplete

Medium · published April 9, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-04-09T19:23Z
EPSS history
Timeline
  • 09 APR 19:23Z
    Apache Tomcat: Fix for CVE-2025-66614 is incomplete
    cvelistv5