Apache Tomcat: Fix for CVE-2025-66614 is incomplete (CVE-2026-32990)

Summary

Apache Tomcat: Fix for CVE-2025-66614 is incomplete

Original description

The description as published by the source.

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami tomcat

[{"type":"SEMVER","events":[{"introduced":"9.0.13"},{"fixed":"9.0.116"},{"introduced":"10.1.50"},{"fixed":"10.1.53"},{"introduced":"11.0.15"},{"fixed":"11.0.20"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-32990 tomcat10 Fixed in: 10.1.55-1~deb12u1
Ubuntu UBUNTU-CVE-2026-32990 tomcat6

References

advisory lists.apache.org
web nvd.nist.gov