Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-32990

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

VectorNETWORK

PublishedApr 09, 2026, 20:16

Published Bysecurity@apache.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.tomcat:tomcat-coyote(Maven)9.0.1139.0.116N/A

org.apache.tomcat:tomcat-coyote(Maven)10.1.5010.1.53N/A

org.apache.tomcat:tomcat-coyote(Maven)11.0.1511.0.20N/A

org.apache.tomcat:tomcat(Maven)9.0.1139.0.116N/A

org.apache.tomcat:tomcat(Maven)10.1.5010.1.53N/A

org.apache.tomcat:tomcat(Maven)11.0.1511.0.20N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)9.0.1139.0.116N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)10.1.5010.1.53N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)11.0.1511.0.20N/A

References

https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7

Weakness Type

CWE-20

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK