CVE-2026-65637: Improper Input Validation

August 25, 2026 (updated August 27, 2026)

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

References

lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj
nvd.nist.gov/vuln/detail/CVE-2026-65637

Code Behaviors & Features

Detect and mitigate CVE-2026-65637 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →