Critical severity9.8NVD Advisory· Published Aug 25, 2026· Updated Aug 27, 2026

CVE-2026-65637

Description

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Apache/Tomcatllm-fuzzy
Range: 11.0.20 - 11.0.24, 10.1.53 - 10.1.57, 9.0.115 - 9.0.120
osv-coords7 versions
pkg:bitnami/tomcat pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Tumbleweed
>= 9.0.115, < 9.0.121+ 6 more
- (no CPE)range: >= 9.0.115, < 9.0.121
- (no CPE)range: < 9.0.121-160000.1.1
- (no CPE)range: < 9.0.121-1.1
- (no CPE)range: < 10.1.59-160000.1.1
- (no CPE)range: < 10.1.59-1.1
- (no CPE)range: < 11.0.25-160000.1.1
- (no CPE)range: < 11.0.25-1.1