CVE-2026-32990

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de validación de entrada incorrecta en Apache Tomcat debido a una corrección incompleta de CVE-2025-66614. Este problema afecta a Apache Tomcat: desde 11.0.15 hasta 11.0.19, desde 10.1.50 hasta 10.1.52, desde 9.0.113 hasta 9.0.115. Se recomienda a los usuarios actualizar a la versión 11.0.20, 10.1.53 o 9.0.116, que corrigen el problema.

Information

Published : 2026-04-09 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-32990

Mitre link : CVE-2026-32990

CVE.ORG link : CVE-2026-32990

JSON object : View

Products Affected

apache

tomcat

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-32990", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32990", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:38:40.304932Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.15", "versionType": "semver", "lessThanOrEqual": "11.0.19"}, {"status": "affected", "version": "10.1.50", "versionType": "semver", "lessThanOrEqual": "10.1.52"}, {"status": "affected", "version": "9.0.113", "versionType": "semver", "lessThanOrEqual": "9.0.115"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T20:16:24.810", "references": [{"url": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.\n\nThis issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada incorrecta en Apache Tomcat debido a una correcci\u00f3n incompleta de CVE-2025-66614.\n\nEste problema afecta a Apache Tomcat: desde 11.0.15 hasta 11.0.19, desde 10.1.50 hasta 10.1.52, desde 9.0.113 hasta 9.0.115.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 11.0.20, 10.1.53 o 9.0.116, que corrigen el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C1B78A4-9291-45F2-8A32-B6C5DB17AB05", "versionEndExcluding": "9.0.116", "versionStartIncluding": "9.0.113"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "216DAD3C-4186-4501-BE76-71EAAFCD4330", "versionEndExcluding": "10.1.53", "versionStartIncluding": "10.1.50"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0369EA67-355F-4E24-B5EE-6E7775EB3C31", "versionEndExcluding": "11.0.20", "versionStartIncluding": "11.0.15"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}