CVE-2026-32990

State: PUBLISHED · Published: 2026-04-09 · Updated: 2026-04-10 · Assigner: apache

Description

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

CWE

CWE-20 — CWE-20 Improper Input Validation

Affected

Apache Software Foundation / Apache Tomcat — v=11.0.15 ≤11.0.19 [affected]; v=10.1.50 ≤10.1.52 [affected]; v=9.0.113 ≤9.0.115 [affected]

CVSS

(none)

References

https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7 vendor-advisory

Source

cvelistV5-main/cves/2026/32xxx/CVE-2026-32990.json