CVE-2026-32990: Apache Tomcat Input Validation Vulnerability

CVE-2026-32990 Overview

CVE-2026-32990 is an Improper Input Validation vulnerability affecting Apache Tomcat that stems from an incomplete fix of the previously disclosed CVE-2025-66614. This vulnerability exists because the original patch did not fully address the underlying input validation issue, leaving affected versions susceptible to exploitation through similar attack vectors.

The vulnerability is classified under CWE-20 (Improper Input Validation), indicating that the application fails to properly validate user-supplied input before processing. This type of flaw can allow attackers to send specially crafted requests that bypass security controls or cause unintended application behavior.

Critical Impact

Apache Tomcat servers running affected versions remain vulnerable to input validation attacks despite having applied the CVE-2025-66614 patch. Organizations that believed they were protected after the initial fix must upgrade again to fully remediate this security issue.

Affected Products

• Apache Tomcat 11.0.15 through 11.0.19
• Apache Tomcat 10.1.50 through 10.1.52
• Apache Tomcat 9.0.113 through 9.0.115

Discovery Timeline

• 2026-04-09 - CVE-2026-32990 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-32990

Vulnerability Analysis

This vulnerability represents an incomplete remediation of CVE-2025-66614, where the original security patch failed to address all attack vectors associated with the improper input validation issue. When security fixes do not comprehensively cover all edge cases, residual vulnerabilities can persist, allowing attackers to continue exploiting the same underlying weakness through alternative methods.

Apache Tomcat is a widely deployed open-source Java servlet container that processes HTTP requests for Java-based web applications. Input validation vulnerabilities in such critical infrastructure can have far-reaching implications, potentially affecting request processing, session management, or application security boundaries.

Root Cause

The root cause of CVE-2026-32990 is an incomplete fix for CVE-2025-66614. The original patch addressed some input validation scenarios but did not account for all possible malformed or malicious input patterns. This allowed certain crafted inputs to still bypass validation checks and be processed by the application in unintended ways.

Incomplete patches are a common occurrence in complex software systems where the initial fix may address the specific proof-of-concept or reported attack vector without fully understanding or mitigating all variations of the vulnerability.

Attack Vector

The specific attack vector for this vulnerability has not been fully detailed in public disclosures. However, as an improper input validation flaw in a web server, potential attack scenarios may include:

• Crafted HTTP requests that bypass sanitization checks
• Malformed headers or parameters that trigger unexpected processing paths
• Input sequences that exploit edge cases not covered by the original CVE-2025-66614 fix

Organizations should consult the Apache Mailing List Update for detailed technical information about the vulnerability mechanism and exploitation scenarios.

Detection Methods for CVE-2026-32990

Indicators of Compromise

• Unusual HTTP request patterns targeting Tomcat endpoints with malformed or unexpected input values
• Application log entries showing input validation errors or unexpected exception handling
• Anomalous request headers or parameters that deviate from expected application behavior

Detection Strategies

• Monitor Apache Tomcat access logs for requests with unusual character sequences or encoding patterns
• Implement web application firewall (WAF) rules to detect and block common input validation bypass attempts
• Review application logs for increased error rates that may indicate exploitation attempts

Monitoring Recommendations

• Enable detailed request logging on Apache Tomcat servers to capture full request details
• Configure alerting for anomalous traffic patterns or spikes in 4xx/5xx error responses
• Implement integrity monitoring on Tomcat configuration files and deployed applications

How to Mitigate CVE-2026-32990

Immediate Actions Required

• Upgrade Apache Tomcat to version 11.0.20, 10.1.53, or 9.0.116 depending on your deployment branch
• Verify all Tomcat instances in your environment and ensure no vulnerable versions remain deployed
• Review access logs for any suspicious activity that may indicate prior exploitation attempts

Patch Information

Apache has released patched versions that fully address this vulnerability:

For additional information and the official advisory, refer to the Apache Mailing List Update.

Workarounds

• Deploy a web application firewall (WAF) with strict input validation rules to filter potentially malicious requests while awaiting patching
• Implement network segmentation to limit exposure of Tomcat servers to untrusted networks
• Consider temporarily restricting access to affected Tomcat instances to trusted IP ranges until upgrades can be completed

# Verify your current Tomcat version
catalina.sh version
# or on Windows
catalina.bat version

# After upgrade, verify the patched version is running
# Expected output should show 11.0.20, 10.1.53, or 9.0.116