Executive brief
Apache Tomcat, a widely used web server and application container, contains a vulnerability in how it validates incoming data. This flaw could allow an attacker to potentially access sensitive information that should otherwise be protected. Organizations using affected versions should update to the latest patched releases to maintain the security of their web applications.
Technical details
Apache Tomcat is vulnerable to improper input validation (CWE-20) resulting from an incomplete fix for CVE-2025-66614. The vulnerability exists in the core and Coyote components across multiple major versions (9.x, 10.x, and 11.x). A remote, unauthenticated attacker can exploit this over the network without user interaction. Successful exploitation can lead to a loss of confidentiality. Patches are available in versions 9.0.116, 10.1.53, and 11.0.20.
Affected products
- Apache Tomcat 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.19
- Apache tomcat-embed-core 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.19
- Apache tomcat-coyote 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.18
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-10: other: GitHub reviewed the advisory