BIT-tomcat-2026-65637: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

Check the Apache Tomcat version in use. Affected releases are 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120.

Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121, as appropriate for the deployed release line. These versions fix the issue.

Published Aug 25, 2026

Updated

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Affected Software

1 affected component

Apache Tomcat>=11.0.20<=11.0.24, >=10.1.53<=10.1.57, >=9.0.115<=9.0.120

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 11.0.25
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 10.1.58
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 9.0.121

Aug 25, 2026

CVE Published

via OSV·09:49 PM

Data Sourced

via OSV·09:49 PM

DescriptionSeverityWeakness

Check the Apache Tomcat version in use. Affected releases are 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120.

Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121, as appropriate for the deployed release line. These versions fix the issue.