CVE-2026-65637 in Tomcat
Summary
by MITRE • 08/26/2026
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Apache Tomcat web server has been identified with a critical security flaw stemming from improper input validation within its HTTP request processing logic. This vulnerability is directly related to an incomplete remediation of CVE-2026-32990, indicating that previous patches failed to fully address the underlying code path responsible for handling malformed or maliciously crafted inputs. The issue resides in how Tomcat parses and validates specific components of incoming HTTP requests, particularly those involving URI decoding and parameter processing. When a request contains specially constructed input sequences designed to bypass existing validation checks, the server may fail to reject them as expected, allowing potentially dangerous data to propagate through the application stack. This type of flaw is characteristic of CWE-20 Improper Input Validation, where software does not adequately verify that incoming data conforms to expected formats, lengths, or character sets before processing it further.
The operational impact of this vulnerability can be severe depending on how Tomcat is deployed and what applications are running atop it. Attackers who exploit this flaw may achieve unauthorized access to sensitive resources, trigger denial-of-service conditions by causing the server to enter an unstable state, or potentially execute arbitrary code if other vulnerabilities exist in conjunction with this input validation failure. Because Apache Tomcat serves as a foundational component for many Java-based web applications and enterprise systems, compromising it can lead to broader infrastructure breaches. The vulnerability affects multiple recent versions of Tomcat, specifically releases from 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120. This wide range of affected versions suggests that the flaw is embedded in core request handling mechanisms shared across these release lines rather than being isolated to a single feature set.
From an offensive security perspective, this vulnerability aligns with techniques observed in the MITRE ATT&CK framework under categories such as Initial Access and Execution via web applications. Attackers often leverage improper input validation to bypass authentication controls or inject malicious payloads into server-side processes. The fact that this is described as an incomplete fix for a prior CVE implies that threat actors may have already developed working exploits against earlier patched versions, making the current situation particularly urgent. Organizations relying on these specific Tomcat releases are at immediate risk of exploitation unless corrective actions are taken promptly.
To mitigate this vulnerability, administrators must upgrade Apache Tomcat to version 11.0.25 for the 11.x branch, 10.1.58 for the 10.1.x branch, or 9.0.121 for the legacy 9.0.x line. These versions contain the complete remediation code that addresses both the original CVE-2026-32990 and this subsequent incomplete fix issue. In addition to upgrading, organizations should implement defense-in-depth strategies such as deploying Web Application Firewalls (WAFs) configured with rulesets tailored to detect anomalous HTTP request patterns associated with input validation bypasses. Regular security audits and penetration testing focused on URI parsing and parameter handling can help identify residual weaknesses in application logic that rely on Tomcat for request processing. Maintaining up-to-date software components is the most effective primary defense against such vulnerabilities, ensuring that known attack vectors are neutralized at the platform level before they can be leveraged by adversaries.