[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a266e26f-3129-40dc-8b43-47f4994d7e95@apache.org>
Date: Thu, 9 Apr 2026 20:49:44 +0100
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-32990: Apache Tomcat: Fix for CVE-2025-66614 is incomplete
Severity: moderate
Affected versions:
- Apache Tomcat 11.0.15 through 11.0.19
- Apache Tomcat 10.1.50 through 10.1.52
- Apache Tomcat 9.0.113 through 9.0.115
Description:
Improper Input Validation vulnerability in Apache Tomcat due to an
incomplete fix of CVE-2025-66614.
This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from
10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116,
which fix the issue.
Credit:
zhengg (finder)
References:
https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-32990
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
