Vulnerability GHSA-f525-44xv-f2qj

Critical

2 months ago

Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

9.0.115 - 9.0.120 and 10.1.53 - 10.1.57 and 11.0.20 - 11.0.24

Summary

Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

Details

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.

Users are recommended to upgrade to version 11.0.25, 10.1.59 or 9.0.121, which fix the issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Critical

2 months ago

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794

Critical

2 months ago

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-gcx9-497g-6cp6

Critical

2 months ago

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-h3x4-894j-xpx5

Critical

5 months ago

Apache Tomcat - Security constraints not correctly applied

7.0.0 - 9.0.117 and 10.1.0-M1 - 10.1.54 and 11.0.0-M1 - 11.0.21 GHSA-5m62-pw8w-7w9f

High Risk

5 months ago

Apache Tomcat: LockOutRealm treats user names as case-sensitive

7.0.0 - 9.0.117 and 10.1.0-M1 - 10.1.54 and 11.0.0-M1 - 11.0.21 GHSA-5mp6-jrq3-r938

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

2 months ago

Fixed (11.0.25)

Unknown

Fixed (10.1.59)

Unknown

Fixed (9.0.121)

Unknown

Fixed (11.0.25)

Unknown

Fixed (10.1.59)

Unknown

Fixed (9.0.121)

Unknown

Last Modified

7 days ago