CVE-2026-32990

Fixed in a distro release EPSS <1%CVSS 5.3

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Published 2026-04-09 · CVE record · OSV

Products: Apache Software Foundation Apache Tomcat

Fixed upstream

Ecosystem	Package	Fixed in
Maven	org.apache.tomcat.embed:tomcat-embed-core	9.0.116
Maven	org.apache.tomcat.embed:tomcat-embed-core	10.1.53
Maven	org.apache.tomcat.embed:tomcat-embed-core	11.0.20
Maven	org.apache.tomcat:tomcat	9.0.116
Maven	org.apache.tomcat:tomcat	10.1.53
Maven	org.apache.tomcat:tomcat	11.0.20
Maven	org.apache.tomcat:tomcat-coyote	9.0.116
Maven	org.apache.tomcat:tomcat-coyote	10.1.53
Maven	org.apache.tomcat:tomcat-coyote	11.0.20

Distro releases

Release	Package	Fixed in
AlmaLinux 10	tomcat	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-admin-webapps	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-docs-webapp	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-el-5.0-api	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-jsp-3.1-api	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-lib	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-servlet-6.0-api	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat-webapps	1:10.1.49-4.el10_2.alma.1
AlmaLinux 10	tomcat9	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-admin-webapps	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-docs-webapp	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-el-3.0-api	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-jsp-2.3-api	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-lib	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-servlet-4.0-api	1:9.0.120-1.el10_2.alma.1
AlmaLinux 10	tomcat9-webapps	1:9.0.120-1.el10_2.alma.1
AlmaLinux 9	tomcat	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-admin-webapps	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-docs-webapp	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-el-3.0-api	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-jsp-2.3-api	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-lib	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-servlet-4.0-api	1:9.0.120-2.el9_8
AlmaLinux 9	tomcat-webapps	1:9.0.120-2.el9_8
Chainguard	camunda-8.8	8.8.22-r0
Chainguard	camunda-zeebe-8.6	8.6.39-r0
Chainguard	camunda-zeebe-8.7	8.7.27-r0
Chainguard	camunda-zeebe-8.8	8.8.22-r0
Chainguard	kayenta-2025.0	2025.0.8-r11
Chainguard	kayenta-2025.1	2025.1.6-r9
Chainguard	kayenta-2025.2	2025.2.4-r5
Chainguard	kayenta-2025.4	2025.4.3-r6
Chainguard	kayenta-2026.0	2026.0.2-r6
Chainguard	kayenta-fips-2025.0	2025.0.8-r13
Chainguard	kayenta-fips-2025.1	2025.1.6-r10
Chainguard	kayenta-fips-2025.2	2025.2.4-r6
Chainguard	kayenta-fips-2025.4	2025.4.3-r7
Chainguard	kayenta-fips-2026.0	2026.0.2-r7
Chainguard	nacos	3.2.0-r6
Chainguard	nacos-docker	3.2.0-r2
Chainguard	ontop	5.5.0-r8
Chainguard	ontop-fips	5.5.0-r4
Chainguard	thingsboard-tb-mqtt-transport	4.3.1.1-r11
Chainguard	thingsboard-tb-node	4.3.1.1-r11
Debian 12	tomcat10	10.1.55-1~deb12u1
Debian 12	tomcat9	9.0.70-2
Debian 13	tomcat10	10.1.55-1~deb13u1
Debian 13	tomcat11	11.0.22-1~deb13u1
Debian 13	tomcat9	9.0.70-2
Debian 14	tomcat10	10.1.54-1
Debian 14	tomcat11	11.0.21-1
Debian 14	tomcat9	9.0.70-2
Red Hat Enterprise Linux 10.2	tomcat	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-admin-webapps	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-docs-webapp	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-el-5.0-api	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-jsp-3.1-api	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-lib	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-servlet-6.0-api	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat-webapps	1:10.1.49-4.el10_2
Red Hat Enterprise Linux 10.2	tomcat9	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-admin-webapps	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-docs-webapp	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-el-3.0-api	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-jsp-2.3-api	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-lib	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-servlet-4.0-api	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 10.2	tomcat9-webapps	1:9.0.120-1.el10_2
Red Hat Enterprise Linux 9	tomcat	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-admin-webapps	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-docs-webapp	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-el-3.0-api	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-jsp-2.3-api	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-lib	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-servlet-4.0-api	1:9.0.120-2.el9_8
Red Hat Enterprise Linux 9	tomcat-webapps	1:9.0.120-2.el9_8
Red Hat Enterprise Linux eus 10.0	tomcat	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-admin-webapps	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-docs-webapp	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-el-5.0-api	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-jsp-3.1-api	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-lib	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-servlet-6.0-api	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat-webapps	1:10.1.49-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-admin-webapps	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-docs-webapp	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-el-3.0-api	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-jsp-2.3-api	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-lib	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-servlet-4.0-api	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-webapps	1:9.0.120-1.el10_0
Red Hat jboss enterprise web server 6.2	jws6-tomcat	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-admin-webapps	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-admin-webapps	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-admin-webapps	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-docs-webapp	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-docs-webapp	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-docs-webapp	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-el-5.0-api	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-el-5.0-api	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-el-5.0-api	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-javadoc	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-javadoc	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-javadoc	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-jsp-3.1-api	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-jsp-3.1-api	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-jsp-3.1-api	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-lib	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-lib	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-lib	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-selinux	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-selinux	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-selinux	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-servlet-6.0-api	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-servlet-6.0-api	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-servlet-6.0-api	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-webapps	0:10.1.49-10.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-webapps	0:10.1.49-10.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-webapps	0:10.1.49-10.redhat_00008.1.el8jws
Red Hat rhel e4s 9.2	tomcat	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-admin-webapps	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-docs-webapp	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-el-3.0-api	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-jsp-2.3-api	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-lib	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-servlet-4.0-api	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-webapps	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.4	tomcat	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-admin-webapps	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-docs-webapp	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-el-3.0-api	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-jsp-2.3-api	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-lib	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-servlet-4.0-api	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-webapps	1:9.0.120-1.el9_4
Red Hat rhel eus 9.6	tomcat	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-admin-webapps	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-docs-webapp	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-el-3.0-api	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-jsp-2.3-api	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-lib	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-servlet-4.0-api	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-webapps	1:9.0.120-1.el9_6
Rocky Linux 10	tomcat	1:10.1.49-4.el10_2
Rocky Linux 10	tomcat9	1:9.0.120-1.el10_2
Rocky Linux 9	tomcat	1:9.0.120-2.el9_8
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	tomcat11	11.0.21-150600.13.18.1
SUSE Linux Enterprise Server 12 SP5-LTSS	tomcat	9.0.117-3.163.2
SUSE Linux Enterprise Server 15 SP4-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP5-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP5-LTSS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server 15 SP6-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP6-LTSS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server 15 SP6-LTSS	tomcat11	11.0.21-150600.13.18.1
SUSE Linux Enterprise Server 16.0	tomcat	9.0.121-160000.1.1
SUSE Linux Enterprise Server 16.0	tomcat10	10.1.59-160000.1.1
SUSE Linux Enterprise Server 16.0	tomcat11	11.0.25-160000.1.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	tomcat	9.0.117-3.163.2
SUSE Linux Enterprise Server for SAP Applications 15 SP4	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6	tomcat11	11.0.21-150600.13.18.1
SUSE Linux Enterprise Server for SAP applications 16.0	tomcat	9.0.121-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0	tomcat10	10.1.59-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0	tomcat11	11.0.25-160000.1.1
Ubuntu 26.04 LTS	tomcat11	no fix
Ubuntu 26.04 LTS	tomcat9	no fix
Wolfi	thingsboard-tb-mqtt-transport	4.3.1.1-r11
Wolfi	thingsboard-tb-node	4.3.1.1-r11
openSUSE Leap 16.0	tomcat	9.0.121-160000.1.1
openSUSE Leap 16.0	tomcat	9.0.117-160000.1.1
openSUSE Leap 16.0	tomcat10	10.1.59-160000.1.1
openSUSE Leap 16.0	tomcat10	10.1.54-160000.1.1
openSUSE Leap 16.0	tomcat11	11.0.25-160000.1.1
openSUSE Leap 16.0	tomcat11	11.0.21-160000.1.1
openSUSE Tumbleweed	tomcat	9.0.117-1.1
openSUSE Tumbleweed	tomcat10	10.1.54-1.1
openSUSE Tumbleweed	tomcat11	11.0.21-1.1