CVE-2026-32990

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32990
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32990.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-32990
Aliases
Downstream
CGA (40)
CLEANSTART (2)
CLSA (1)
DEBIAN (1)
MGASA (1)
MINI (3)
OESA (1)
openSUSE (9)
RHSA (9)
RLSA (2)
ROOT (1)
SUSE (7)
UBUNTU (1)
Related
ALSA (2)
openSUSE (9)
SUSE (7)
Published
2026-04-09T19:23:49Z
Modified
2026-09-19T08:41:26Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Apache Tomcat: Fix for CVE-2025-66614 is incomplete
Details

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32990.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "11.0.15"
                },
                {
                    "last_affected":  "11.0.19"
                },
                {
                    "introduced":  "10.1.50"
                },
                {
                    "last_affected":  "10.1.52"
                },
                {
                    "introduced":  "9.0.113"
                },
                {
                    "last_affected":  "9.0.115"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "11.0.15"
                },
                {
                    "fixed":  "11.0.19"
                },
                {
                    "introduced":  "10.1.50"
                },
                {
                    "fixed":  "10.1.52"
                },
                {
                    "introduced":  "9.0.113"
                },
                {
                    "fixed":  "9.0.115"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
1da89d3d01aece456d622548d92055a60ff19c37
Fixed
d2c7dce5e94d6d1d81ad7d66402140b1c1962a53
Introduced
cd6d685800b0e46797325866dee2c9a78fc8e69c
Fixed
f3d5786aa1bd6c2a78d666afc89b2a4570f66593
Introduced
692d6ffc5aa75d6804749ffcc14353c6b046fd92
Fixed
1c65de6f27a3bac481514e56e3637785b65a4f2c
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "9.0.113"
        },
        {
            "fixed":  "9.0.116"
        },
        {
            "introduced":  "10.1.50"
        },
        {
            "fixed":  "10.1.53"
        },
        {
            "introduced":  "11.0.15"
        },
        {
            "fixed":  "11.0.20"
        }
    ],
    "source":  "CPE_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32990.json"