Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

org.apache.tomcat:tomcat-coyote (maven), org.apache.tomcat.embed:tomcat-embed-core (maven)

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.

Fix it

org.apache.tomcat:tomcat-coyote maven

On 9.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat:tomcat-coyote -DdepVersion=9.0.121 -DforceVersion=true
On 10.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat:tomcat-coyote -DdepVersion=10.1.59 -DforceVersion=true
On 11.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat:tomcat-coyote -DdepVersion=11.0.25 -DforceVersion=true

org.apache.tomcat.embed:tomcat-embed-core maven

On 9.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat.embed:tomcat-embed-core -DdepVersion=9.0.121 -DforceVersion=true
On 10.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat.embed:tomcat-embed-core -DdepVersion=10.1.59 -DforceVersion=true
On 11.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat.embed:tomcat-embed-core -DdepVersion=11.0.25 -DforceVersion=true

First seen: 26 Aug 2026
Last update: 26 Aug 2026, 00:30 UTC
Fixed in: org.apache.tomcat:tomcat-coyote 11.0.25
org.apache.tomcat:tomcat-coyote 10.1.59
org.apache.tomcat:tomcat-coyote 9.0.121
org.apache.tomcat.embed:tomcat-embed-core 11.0.25
org.apache.tomcat.embed:tomcat-embed-core 10.1.59
org.apache.tomcat.embed:tomcat-embed-core 9.0.121
Identifiers: CVE-2026-65637
Source: GitHub advisory
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
Severity: critical. Patch status: patched.
Affected: org.apache.tomcat:tomcat-coyote (maven), org.apache.tomcat.embed:tomcat-embed-core (maven)
Fixed in: org.apache.tomcat:tomcat-coyote 11.0.25, org.apache.tomcat:tomcat-coyote 10.1.59, org.apache.tomcat:tomcat-coyote 9.0.121, org.apache.tomcat.embed:tomcat-embed-core 11.0.25, org.apache.tomcat.embed:tomcat-embed-core 10.1.59, org.apache.tomcat.embed:tomcat-embed-core 9.0.121
Ids: CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.

## Steps
1. Search the repo, its CI and infra config for org.apache.tomcat:tomcat-coyote (maven), org.apache.tomcat.embed:tomcat-embed-core (maven). If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-65637") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-f525-44xv-f2qj https://github.com/apache/tomcat/commit/40012414df828a56126f76a7339669c7c919aae7 https://github.com/apache/tomcat/commit/8639b20f045c88f356b887204f52e897399f0de7 https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj https://nvd.nist.gov/vuln/detail/CVE-2026-65637
https://pwned.coffee/i/apache-tomcat-http-2-no-authority-bypass-of-strict-sni-v-cve-2026-65637

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee