Apache Tomcat up to 8.5.100/9.0.112/10.1.49/11.0.14 TLS Configuration certificate validation

Summaryinfo

A vulnerability was found in Apache Tomcat up to 8.5.100/9.0.112/10.1.49/11.0.14. It has been rated as critical. The impacted element is an unknown function of the component TLS Configuration Handler. Performing a manipulation results in certificate validation. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability was named CVE-2025-66614. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Apache Tomcat up to 8.5.100/9.0.112/10.1.49/11.0.14. It has been classified as problematic. This affects an unknown function of the component TLS Configuration Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. The summary by CVE is:

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2025-66614 since 12/05/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/23/2026). MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 299403 (Apache Tomcat 11.0.0.M1 < 11.0.15 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.113, 10.1.50 or 11.0.15 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (299403) and CERT Bund (WID-SEC-2026-0443). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Amazon Linux 2
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• SUSE Linux
• SUSE openSUSE
• Apache Tomcat
• Open Source Camunda
• Dell Secure Connect Gateway

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5.100
• 9.0.112
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 10.1.40
• 10.1.41
• 10.1.42
• 10.1.43
• 10.1.44
• 10.1.45
• 10.1.46
• 10.1.47
• 10.1.48
• 10.1.49
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14

License

• open-source

Support

• end of life

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion