CVE-2026-65637

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65637
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-65637.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-65637
Aliases
Downstream
ALSA (2)
CGA (14)
DEBIAN (1)
MGASA (1)
MINI (5)
OESA (1)
openSUSE (6)
RHSA (3)
RLSA (2)
SUSE (10)
UBUNTU (1)
Related
ALSA (2)
openSUSE (6)
SUSE (10)
Published
2026-08-25T21:49:13Z
Modified
2026-11-02T23:12:04Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
Details

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65637.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "11.0.20"
                        },
                        {
                            "last_affected": "11.0.24"
                        },
                        {
                            "introduced": "10.1.53"
                        },
                        {
                            "last_affected": "10.1.57"
                        },
                        {
                            "introduced": "9.0.115"
                        },
                        {
                            "last_affected": "9.0.120"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
fd3e7b16a7ead52f696b827178333f9a00696d25
Fixed
dc00a53100b38c8eb8befce5855e3b152eed9353
Introduced
f3d5786aa1bd6c2a78d666afc89b2a4570f66593
Fixed
96f28aed7efb331abb67b55319072e9de3240e6f
Introduced
1c65de6f27a3bac481514e56e3637785b65a4f2c
Fixed
cbe6e15ee81e2fc6232954292a80cca5d1e84009
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.115"
                },
                {
                    "fixed": "9.0.121"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.53"
                },
                {
                    "fixed": "10.1.58"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "11.0.20"
                },
                {
                    "fixed": "11.0.25"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-65637.json"