CVE-2026-65637: Apache Tomcat Input Validation Vulnerability

CVE-2026-65637 is an improper input validation flaw in Apache Tomcat stemming from an incomplete fix for a previous vulnerability. This security issue affects multiple Tomcat versions and could compromise server security. This post explains its technical details, affected versions, potential impact, and available mitigation steps.

CVE-2026-65637 Overview

CVE-2026-65637 is an improper input validation vulnerability in Apache Tomcat caused by an incomplete fix for CVE-2026-32990. The flaw affects multiple Tomcat release branches and is classified under [CWE-20]. The Apache Software Foundation released patched versions 11.0.25, 10.1.58, and 9.0.121 to address the issue.

The vulnerability is remotely exploitable over the network without authentication or user interaction. Given Apache Tomcat's widespread deployment as a Java servlet container in enterprise applications, the exposure surface is substantial.

Critical Impact
Unauthenticated network-based attackers can exploit improper input validation in Apache Tomcat to compromise confidentiality, integrity, and availability of affected servers.

Affected Products

Apache Tomcat 11.0.20 through 11.0.24
Apache Tomcat 10.1.53 through 10.1.57
Apache Tomcat 9.0.115 through 9.0.120

Discovery Timeline

2026-08-25 - CVE-2026-65637 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65637

Vulnerability Analysis

CVE-2026-65637 stems from an incomplete remediation of the earlier CVE-2026-32990 issue in Apache Tomcat. The prior patch failed to fully validate certain input conditions, leaving an exploitable code path in the servlet container. Attackers can send crafted requests over the network to trigger the improper input validation behavior. The flaw impacts confidentiality, integrity, and availability of the affected server.

The vulnerability is tracked under [CWE-20] Improper Input Validation. Because Tomcat processes untrusted HTTP input as part of normal operation, the attack surface is directly exposed on any internet-facing or intranet-facing deployment. No authentication or user interaction is required to exploit the condition.

Root Cause

The root cause is an incomplete fix applied for CVE-2026-32990. The original patch did not fully cover the vulnerable input handling logic. Residual validation gaps remained in versions 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120. Refer to the Apache Mailing List Thread for technical details published by the Apache Tomcat project.

Attack Vector

Exploitation occurs over the network against exposed Tomcat instances. An attacker submits specially crafted input that bypasses the incomplete validation logic introduced by the prior fix. Successful exploitation can lead to high impact across confidentiality, integrity, and availability. No public proof-of-concept exploit is currently referenced in the CVE data.

Detection Methods for CVE-2026-65637

Indicators of Compromise

Unexpected HTTP requests to Tomcat endpoints containing malformed or unusual protocol elements that deviate from standard client behavior.
Anomalous Tomcat process behavior including unexpected child processes, outbound network connections, or file system modifications under the Tomcat runtime user.
Error entries in catalina.out or access logs indicating parsing failures or handler exceptions correlated with external source IPs.

Detection Strategies

Inventory all Apache Tomcat installations and identify instances running vulnerable versions 9.0.115-9.0.120, 10.1.53-10.1.57, or 11.0.20-11.0.24.
Deploy web application firewall rules that inspect and normalize HTTP request components sent to Tomcat listeners.
Correlate Tomcat access logs with process telemetry to identify anomalous request patterns preceding suspicious server-side activity.

Monitoring Recommendations

Enable verbose access logging on Tomcat connectors and forward logs to a centralized analytics platform for retention and analysis.
Monitor the Java Virtual Machine (JVM) process running Tomcat for unexpected spawned processes, memory anomalies, or outbound connections.
Establish baseline HTTP request patterns for each Tomcat application and alert on statistically significant deviations.

How to Mitigate CVE-2026-65637

Immediate Actions Required

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 depending on the deployed release branch.
Restrict network exposure of Tomcat management and application connectors to trusted networks until patching completes.
Review Tomcat access logs for signs of exploitation attempts targeting the affected versions.

Patch Information

The Apache Software Foundation released fixed versions 11.0.25, 10.1.58, and 9.0.121. Administrators should download the appropriate release from the official Apache Tomcat distribution channels. Full details are available in the Apache Mailing List Thread announcing the fix.

Workarounds

Place a reverse proxy or web application firewall in front of Tomcat to filter and normalize inbound HTTP requests.
Limit inbound access to Tomcat connectors using network segmentation and host-based firewall rules.
Disable unused Tomcat connectors and applications to reduce the exploitable surface until upgrade is complete.

bash

# Verify installed Tomcat version before and after upgrade
$CATALINA_HOME/bin/version.sh

# Example: restrict Tomcat HTTP connector to localhost in server.xml
# <Connector port="8080" protocol="HTTP/1.1" address="127.0.0.1" />