Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

CVSS Details

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon Linux Ami 2	—	Upgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-docs-webapp	May 20, 2026	May 20, 2026
Apache Tomcat	—	Upgrade Apache Tomcat to 11.0.20Upgrade Apache Tomcat to 9.0.116Upgrade Apache Tomcat to 10.1.53Upgrade Apache Tomcat to the latest available version	May 19, 2026	Apr 9, 2026
Debian	—	Upgrade tomcat10Upgrade tomcat9Upgrade tomcat11	Apr 13, 2026	Apr 13, 2026
Redhat_linux	—	Upgrade tomcat9-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-3.1-apiUpgrade jws6-tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiNo solution existsUpgrade tomcat9-libUpgrade tomcat-libUpgrade tomcat9-admin-webappsUpgrade jws6-tomcat-servlet-6.0-apiUpgrade jws6-tomcat-selinuxUpgrade jws6-tomcat-el-5.0-apiUpgrade jws6-tomcat-javadocUpgrade tomcat9Upgrade tomcat-docs-webappUpgrade jws6-tomcat-libUpgrade jws6-tomcat-webappsUpgrade tomcat-el-5.0-apiUpgrade tomcat9-jsp-2.3-apiUpgrade tomcat-servlet-6.0-apiUpgrade tomcat9-webappsUpgrade tomcat9-el-3.0-apiUpgrade tomcat9-docs-webappUpgrade tomcat-el-3.0-apiUpgrade jws6-tomcat-admin-webappsUpgrade jws6-tomcat-jsp-3.1-apiUpgrade tomcat-servlet-4.0-apiUpgrade jws6-tomcatUpgrade tomcat	May 4, 2026	Apr 9, 2026

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.