Apache Tomcat: Fix for CVE-2025-66614 is incomplete_CVE-2026-32990

5.3 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Basic Information

ID CVE-2026-32990

Source apache

Published Apr 9, 2026 at 19:23

Modified Apr 10, 2026 at 18:39

Affected Product

Vendor Apache Software Foundation

Product Apache Tomcat

Version 11.0.15

Affected Versions Apache Software Foundation Apache Tomcat 11.0.15
Apache Software Foundation Apache Tomcat 10.1.50
Apache Software Foundation Apache Tomcat 9.0.113

CWE Classification

CWE-20

References

lists.apache.org /thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7

{
    "lastseen": "",
    "description": "Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.\n\nThis issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.",
    "published": "2026-04-09T19:23:49.618Z",
    "modified": "2026-04-10T18:39:25.498Z",
    "type": "cve",
    "title": "Apache Tomcat: Fix for CVE-2025-66614 is incomplete",
    "source": "apache",
    "references": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7",
    "id": "CVE-2026-32990",
    "bulletinFamily": "",
    "cwe": [
        "CWE-20"
    ],
    "cvelist": null,
    "sourceData": "Apache Software Foundation Apache Tomcat 11.0.15\nApache Software Foundation Apache Tomcat 10.1.50\nApache Software Foundation Apache Tomcat 9.0.113",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Apache Tomcat",
    "version": "11.0.15",
    "vendor": "Apache Software Foundation",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}