All vulnerabilities
CVE-2026-65637BIT-tomcat-2026-65637GHSA-f525-44xv-f2qj

org.apache.tomcat:tomcat-coyote: Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

Apache Software Foundation org.apache.tomcat:tomcat-coyotemavenWeb servers
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.61%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in11.0.25Also 10.1.59, 9.0.121GitHub
Published25 Aug 2026Updated 27 Oct 2026CVE List

What fixes it

  • 11.0.25org.apache.tomcat:tomcat-coyote, mavenGitHub<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>11.0.25</version></dependency>
  • 10.1.59org.apache.tomcat:tomcat-coyote, mavenGitHub<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>10.1.59</version></dependency>
  • 9.0.121org.apache.tomcat:tomcat-coyote, mavenGitHub<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>9.0.121</version></dependency>
  • 11.0.25org.apache.tomcat.embed:tomcat-embed-core, mavenGitHub<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>11.0.25</version></dependency>
  • 10.1.59org.apache.tomcat.embed:tomcat-embed-core, mavenGitHub<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>10.1.59</version></dependency>
  • 9.0.121org.apache.tomcat.embed:tomcat-embed-core, mavenGitHub<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>9.0.121</version></dependency>
Show all 12 fixed versions
  • 11.0.25org.apache.tomcat:tomcat-coyote, MavenOSV<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>11.0.25</version></dependency>
  • 10.1.59org.apache.tomcat:tomcat-coyote, MavenOSV<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>10.1.59</version></dependency>
  • 9.0.121org.apache.tomcat:tomcat-coyote, MavenOSV<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>9.0.121</version></dependency>
  • 11.0.25org.apache.tomcat.embed:tomcat-embed-core, MavenOSV<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>11.0.25</version></dependency>
  • 10.1.59org.apache.tomcat.embed:tomcat-embed-core, MavenOSV<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>10.1.59</version></dependency>
  • 9.0.121org.apache.tomcat.embed:tomcat-embed-core, MavenOSV<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>9.0.121</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.

Text from GitHub Advisory Database

Affected versions 47

  • org.apache.tomcat:tomcat-coyote, maven>= 11.0.20, < 11.0.25GitHub
  • org.apache.tomcat:tomcat-coyote, maven>= 10.1.53, <= 10.1.57GitHub
  • org.apache.tomcat:tomcat-coyote, maven>= 9.0.115, < 9.0.121GitHub
  • org.apache.tomcat.embed:tomcat-embed-core, maven>= 11.0.20, < 11.0.25GitHub
  • org.apache.tomcat.embed:tomcat-embed-core, maven>= 10.1.53, <= 10.1.57GitHub
  • org.apache.tomcat.embed:tomcat-embed-core, maven>= 9.0.115, < 9.0.121GitHub
  • Apache Tomcataffected: 11.0.20 through 11.0.24CVE List
  • Apache Tomcataffected: 10.1.53 through 10.1.57CVE List
  • Apache Tomcataffected: 9.0.115 through 9.0.120CVE List
  • org.apache.tomcat:tomcat-coyote, Mavenfrom 11.0.20, fixed in 11.0.25OSV
  • org.apache.tomcat:tomcat-coyote, Maven11.0.20OSV
  • org.apache.tomcat:tomcat-coyote, Maven11.0.21OSV
  • org.apache.tomcat:tomcat-coyote, Maven11.0.22OSV
  • org.apache.tomcat:tomcat-coyote, Maven11.0.23OSV
  • org.apache.tomcat:tomcat-coyote, Maven11.0.24OSV
  • org.apache.tomcat:tomcat-coyote, Mavenfrom 10.1.53, fixed in 10.1.59OSV
  • org.apache.tomcat:tomcat-coyote, Maven10.1.53OSV
  • org.apache.tomcat:tomcat-coyote, Maven10.1.54OSV
  • org.apache.tomcat:tomcat-coyote, Maven10.1.55OSV
  • org.apache.tomcat:tomcat-coyote, Maven10.1.56OSV
  • org.apache.tomcat:tomcat-coyote, Maven10.1.57OSV
  • org.apache.tomcat:tomcat-coyote, Mavenfrom 9.0.115, fixed in 9.0.121OSV
  • org.apache.tomcat:tomcat-coyote, Maven9.0.115OSV
  • org.apache.tomcat:tomcat-coyote, Maven9.0.116OSV
  • org.apache.tomcat:tomcat-coyote, Maven9.0.117OSV
  • org.apache.tomcat:tomcat-coyote, Maven9.0.118OSV
  • org.apache.tomcat:tomcat-coyote, Maven9.0.119OSV
  • org.apache.tomcat:tomcat-coyote, Maven9.0.120OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Mavenfrom 11.0.20, fixed in 11.0.25OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven11.0.20OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven11.0.21OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven11.0.22OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven11.0.23OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven11.0.24OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Mavenfrom 10.1.53, fixed in 10.1.59OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven10.1.53OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven10.1.54OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven10.1.55OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven10.1.56OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven10.1.57OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Mavenfrom 9.0.115, fixed in 9.0.121OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven9.0.115OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven9.0.116OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven9.0.117OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven9.0.118OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven9.0.119OSV
  • org.apache.tomcat.embed:tomcat-embed-core, Maven9.0.120OSV

References 12