CVE-2026-65637CWE-20

CVE-2026-65637

Critical · published August 26, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-26T02:17Z
Affected products (3)
ProductVersionsFixed in
apache/tomcat≥ 9.0.115, < 9.0.1219.0.121
apache/tomcat≥ 10.1.53, < 10.1.5810.1.58
apache/tomcat≥ 11.0.20, < 11.0.2511.0.25
References (1)
https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj · [email protected]
EPSS history
Timeline
  • 27 AUG 06:41Z
    EPSS moved — → 0%
    epss
  • 25 AUG 21:49Z
    Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
    cvelistv5