Apache Tomcat: Fix for CVE-2025-66614 is incomplete (CVE-2026-32990)

Résumé

Apache Tomcat: Fix for CVE-2025-66614 is incomplete

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami tomcat

[{"type":"SEMVER","events":[{"introduced":"9.0.13"},{"fixed":"9.0.116"},{"introduced":"10.1.50"},{"fixed":"10.1.53"},{"introduced":"11.0.15"},{"fixed":"11.0.20"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2026-32990 tomcat10 Corrigé dans: 10.1.55-1~deb12u1
Ubuntu UBUNTU-CVE-2026-32990 tomcat6

Références

advisory lists.apache.org
web nvd.nist.gov