CVE-2026-32990: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of . This issue affects Apache Tomcat: from

CVE-2026-32990 · Severity: medium · CVSS 5.3 · Published 2026-04-09

Apache Tomcat, a widely used web server and application container, contains a vulnerability in how it validates incoming data. This flaw could allow an attacker to potentially access sensitive information that should otherwise be protected. Organizations using affected versions should update to the latest patched releases to maintain the security of their web applications.

Technologies: Apache Tomcat, Apache Tomcat-Coyote, Apache Tomcat-Embed-Core, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-32990 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32990 being exploited in the wild.
How severe is CVE-2026-32990?
Medium severity, with a CVSS score of 5.3, published 9 April 2026.
Which products and versions are affected?
Apache Tomcat 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.19; Apache Tomcat-Coyote 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.18; Apache Tomcat-Embed-Core 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.19; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=9.0.113,fixed=9.0.116; and 2 more.
Is there a fix for CVE-2026-32990?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 9.0.116 or later; org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.116 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.116 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32990 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32990?
Check whether you run Apache Tomcat, Apache Tomcat-Coyote, Apache Tomcat-Embed-Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat:tomcat to 9.0.116 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat:tomcat-coyote to 9.0.116 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 9.0.116 in your pom.xml or build.gradle

Technical details

Apache Tomcat is vulnerable to improper input validation (CWE-20) resulting from an incomplete fix for CVE-2025-66614. The vulnerability exists in the core and Coyote components across multiple major versions (9.x, 10.x, and 11.x). A remote, unauthenticated attacker can exploit this over the network without user interaction. Successful exploitation can lead to a loss of confidentiality. Patches are available in versions 9.0.116, 10.1.53, and 11.0.20.

Affected products

  • Apache Tomcat 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.19
  • Apache tomcat-embed-core 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.19
  • Apache tomcat-coyote 9.0.113 to 9.0.115, 10.1.50 to 10.1.52, 11.0.15 to 11.0.18

Identifiers

  • CVE-2026-32990
  • GHSA-8mc5-53m5-3qj2

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory
  • 2026-04-10: other: GitHub reviewed the advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.