CVE-2026-32990 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2026-32990

Analyzed

More Info Official Page

Source-security@apache.org

Published At-09 Apr, 2026 | 20:16

Updated At-14 Apr, 2026 | 12:47

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CPE Matches

The Apache Software Foundation

>>tomcat>>Versions from 9.0.113(inclusive) to 9.0.116(exclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>tomcat>>Versions from 10.1.50(inclusive) to 10.1.53(exclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>tomcat>>Versions from 11.0.15(inclusive) to 11.0.20(exclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Secondary	security@apache.org

CWE ID: CWE-20

Type: Secondary

Source: security@apache.org

References

Hyperlink	Source	Resource
https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7	security@apache.org	Mailing List Vendor Advisory

Hyperlink: https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7

Source: security@apache.org

Resource:

Mailing List

Vendor Advisory