CVE-2026-65637 — Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation

Back Back to CVE browser

CRITICAL

Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

Published Aug 25, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.74%

Description

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Affected products

Vendor Apache Software Foundation Product Apache Tomcat Default
unaffected
- Version
  10.1.53
  Status
  affected
  Constraints
  <=10.1.57
- Version
  11.0.20
  Status
  affected
  Constraints
  <=11.0.24
- Version
  9.0.115
  Status
  affected
  Constraints
  <=9.0.120

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Tomcat

unaffected

Version	Status	Constraints
10.1.53	affected	<=10.1.57
11.0.20	affected	<=11.0.24
9.0.115	affected	<=9.0.120

Red Hat Hardened Images

tomcat10-main-10.1.59-0.1.hum1

Fixed · RHSA-2026:63137
Red Hat Hardened Images

tomcat11-main-11.0.25-0.1.hum1

Fixed · RHSA-2026:56039
Red Hat Enterprise Linux 10

tomcat

Under investigation
Red Hat Enterprise Linux 10

tomcat9

Under investigation
Red Hat Enterprise Linux 7

tomcat

Under investigation
Red Hat Enterprise Linux 8

pki-deps:10.6/pki-servlet-engine

Under investigation
Red Hat Enterprise Linux 8

tomcat

Under investigation
Red Hat Enterprise Linux 9

tomcat

Under investigation
Red Hat JBoss Web Server 5

tomcat

Out of support scope
Red Hat JBoss Web Server 6

tomcat

Not affected
Red Hat JBoss Web Server 7

tomcat

Affected

Product	Package	State	Advisory
Red Hat Hardened Images	tomcat10-main-10.1.59-0.1.hum1	Fixed	RHSA-2026:63137
Red Hat Hardened Images	tomcat11-main-11.0.25-0.1.hum1	Fixed	RHSA-2026:56039
Red Hat Enterprise Linux 10	tomcat	Under investigation	n/a
Red Hat Enterprise Linux 10	tomcat9	Under investigation	n/a
Red Hat Enterprise Linux 7	tomcat	Under investigation	n/a
Red Hat Enterprise Linux 8	pki-deps:10.6/pki-servlet-engine	Under investigation	n/a
Red Hat Enterprise Linux 8	tomcat	Under investigation	n/a
Red Hat Enterprise Linux 9	tomcat	Under investigation	n/a
Red Hat JBoss Web Server 5	tomcat	Out of support scope	n/a
Red Hat JBoss Web Server 6	tomcat	Not affected	n/a
Red Hat JBoss Web Server 7	tomcat	Affected	n/a

Remediation

Red Hat statement

This Moderate flaw in Apache Tomcat allows an HTTP/2 no-authority bypass of strict Server Name Indication (SNI) validation due to improper input handling. This could lead to requests being misrouted to an unintended virtual host, potentially exposing sensitive information or causing service disruption in specific configurations. The impact is limited as it primarily affects request routing rather than arbitrary code execution.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Metrics

0.74% 0.00738

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00738

Score over time

Aug–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.74% (0.00738)	52.87th	v5 (v2026.06.15)
Aug 26, 2026	0.21% (0.00208)	10.80th	v5 (v2026.06.15)

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-444

References (5)

https://access.redhat.com/security/cve/CVE-2026-65637
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2524155
Issue Tracking
https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj
vendor-advisoryVendor AdvisoryMailing List
https://nvd.nist.gov/vuln/detail/CVE-2026-65637
https://www.cve.org/CVERecord?id=CVE-2026-65637

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-65637		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2524155		Issue Tracking
https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj		vendor-advisoryVendor AdvisoryMailing List
https://nvd.nist.gov/vuln/detail/CVE-2026-65637
https://www.cve.org/CVERecord?id=CVE-2026-65637