---
id: CVE-2026-65637
aliases:
  - GHSA-f525-44xv-f2qj
title: Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
summary: Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
severity: critical
cvss: 9.8
cwe:
  - CWE-20
vendor: apache
product: 'org.apache.tomcat:tomcat-coyote'
ecosystem: maven
affected:
  - 'org.apache.tomcat:tomcat-coyote >= 11.0.20, < 11.0.25'
  - 'org.apache.tomcat:tomcat-coyote >= 10.1.53, <= 10.1.57'
  - 'org.apache.tomcat:tomcat-coyote >= 9.0.115, < 9.0.121'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 11.0.20, < 11.0.25'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 10.1.53, <= 10.1.57'
  - 'org.apache.tomcat.embed:tomcat-embed-core >= 9.0.115, < 9.0.121'
patched:
  - 'org.apache.tomcat:tomcat-coyote 11.0.25'
  - 'org.apache.tomcat:tomcat-coyote 10.1.59'
  - 'org.apache.tomcat:tomcat-coyote 9.0.121'
  - 'org.apache.tomcat.embed:tomcat-embed-core 11.0.25'
  - 'org.apache.tomcat.embed:tomcat-embed-core 10.1.59'
  - 'org.apache.tomcat.embed:tomcat-embed-core 9.0.121'
published: '2026-08-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:45:12Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-f525-44xv-f2qj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65637'
  - url: 'https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj'
  - url: >-
      https://github.com/apache/tomcat/commit/40012414df828a56126f76a7339669c7c919aae7
  - url: >-
      https://github.com/apache/tomcat/commit/8639b20f045c88f356b887204f52e897399f0de7
  - url: >-
      https://github.com/apache/tomcat/commit/b823e88da077f5fa973e34d72359bded9f621e3c
  - url: 'https://github.com/apache/tomcat/releases/tag/10.1.58'
  - url: 'https://github.com/apache/tomcat/releases/tag/11.0.25'
  - url: 'https://github.com/apache/tomcat/releases/tag/9.0.121'
  - url: 'https://tomcat.apache.org/security-10.html'
  - url: 'https://tomcat.apache.org/security-11.html'
  - url: 'https://tomcat.apache.org/security-9.html'
  - url: 'https://github.com/advisories/GHSA-f525-44xv-f2qj'
tags:
  - ghsa
  - maven
epss: 0.00612
epssPercentile: 0.4908
ingestedAt: '2026-10-27T16:11:58.751Z'
---

## Overview

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.

## Affected packages

- `org.apache.tomcat:tomcat-coyote >= 11.0.20, < 11.0.25`
- `org.apache.tomcat:tomcat-coyote >= 10.1.53, <= 10.1.57`
- `org.apache.tomcat:tomcat-coyote >= 9.0.115, < 9.0.121`
- `org.apache.tomcat.embed:tomcat-embed-core >= 11.0.20, < 11.0.25`
- `org.apache.tomcat.embed:tomcat-embed-core >= 10.1.53, <= 10.1.57`
- `org.apache.tomcat.embed:tomcat-embed-core >= 9.0.115, < 9.0.121`

## Remediation

Upgrade to a patched release:

- `org.apache.tomcat:tomcat-coyote 11.0.25`
- `org.apache.tomcat:tomcat-coyote 10.1.59`
- `org.apache.tomcat:tomcat-coyote 9.0.121`
- `org.apache.tomcat.embed:tomcat-embed-core 11.0.25`
- `org.apache.tomcat.embed:tomcat-embed-core 10.1.59`
- `org.apache.tomcat.embed:tomcat-embed-core 9.0.121`