CVE-2026-65637Critical· 9.8▾ MidnightApache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.6%
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.
Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.
org.apache.tomcat:tomcat-coyote >= 11.0.20, < 11.0.25org.apache.tomcat:tomcat-coyote >= 10.1.53, <= 10.1.57org.apache.tomcat:tomcat-coyote >= 9.0.115, < 9.0.121org.apache.tomcat.embed:tomcat-embed-core >= 11.0.20, < 11.0.25org.apache.tomcat.embed:tomcat-embed-core >= 10.1.53, <= 10.1.57org.apache.tomcat.embed:tomcat-embed-core >= 9.0.115, < 9.0.121Upgrade to a patched release:
org.apache.tomcat:tomcat-coyote 11.0.25org.apache.tomcat:tomcat-coyote 10.1.59org.apache.tomcat:tomcat-coyote 9.0.121org.apache.tomcat.embed:tomcat-embed-core 11.0.25org.apache.tomcat.embed:tomcat-embed-core 10.1.59org.apache.tomcat.embed:tomcat-embed-core 9.0.121Connected by shared product, vendor, weakness, or advisory.
CVE-2016-1182High· 8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, …
CVE-2014-0114High· 7.5Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote at…
CVE-2013-4286Medium· 5.8Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incor…
CVE-2013-4322Medium· 4.3Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a …
CVE-2012-3544Medium· 5.0Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
CVE-2020-11987High· 8.2Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel