CVE-2026-65637
Received
Received - Intake
Improper Input Validation in Apache Tomcat
Vulnerability report for CVE-2026-65637, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-25
Last updated on: 2026-08-25
Assigner: Apache Software Foundation
Description
Description
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | From 11.0.20 (inc) to 11.0.24 (inc) |
| apache | tomcat | From 10.1.53 (inc) to 10.1.57 (inc) |
| apache | tomcat | From 9.0.115 (inc) to 9.0.120 (inc) |
| apache | tomcat | 11.0.25 |
| apache | tomcat | 10.1.58 |
| apache | tomcat | 9.0.121 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
