Description

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T22:17:05.177Z",
  "pubdate": "2026-08-25T22:17:05.177Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within Apache Tomcat, stemming from an incomplete remediation of CVE-2026-32990. The vulnerability allows for potential security bypasses or system instability by failing to properly sanitize or validate incoming requests.\nThe affected product, Apache Tomcat, is a widely used open-source web server and servlet container. The issue impacts specific version ranges: 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120.\nThe risk implication is significant as improper input validation can serve as a vector for various secondary attacks, depending on the nature of the unvalidated input. Attackers capable of crafting specific, malicious HTTP requests may potentially exploit this weakness to manipulate internal application logic or bypass security controls. Exploitation generally requires network connectivity to the target Tomcat instance. Organizations running the identified versions are at risk of compromised system integrity and should prioritize upgrading to the specified patched releases to mitigate the threat.",
  "technicalDetails": "The core of this vulnerability lies in the insufficient enforcement of input constraints within the request processing lifecycle of Apache Tomcat. An incomplete fix for CVE-2026-32990 indicates that the original patch failed to account for all possible edge cases or alternative encoding/representation methods of malicious input vectors.\nDuring the HTTP request parsing phase, Tomcat is responsible for validating request headers, parameters, and paths. The vulnerability occurs when the input validation logic is bypassed or circumvented by specific malformed inputs that the previous fix did not adequately restrict. Because the previous remediation was incomplete, the state machine or the validation logic fails to correctly identify or reject inputs that violate expected security constraints.\nThe attack flow typically involves an attacker submitting crafted HTTP requests designed to trigger the vulnerable validation code path. When the Tomcat engine parses these requests, the flawed validation logic allows the processed data to proceed into internal downstream components. Depending on how the application utilizes these inputs, this could facilitate unauthorized actions, parameter pollution, or potentially access to resources that should be restricted.\nAffected versions include 11.0.20-11.0.24, 10.1.53-10.1.57, and 9.0.115-9.0.120. The vulnerability is triggered during the processing of network-originated requests, meaning any attacker with reachability to the Tomcat server can attempt exploitation. There is no implicit requirement for authentication or elevated privileges, as the vulnerability resides within the fundamental request handling mechanism.\nPost-exploitation, the impact is governed by what the underlying application does with the unvalidated input. If the input flows into sensitive sinks, it may lead to security control bypasses. The failure represents a breakdown in the server's contract regarding input integrity, necessitating a comprehensive update to the validation routines in the updated Tomcat releases to address the remaining gaps left by the initial CVE-2026-32990 patch."
}