Loading vulnerability…
Apache Tomcat HTTP/2 Strict SNI Validation Bypass
CVE-2026-65637 is an improper input validation vulnerability in Apache Tomcat caused by an incomplete fix for CVE-2026-32990. HTTP/2 requests lacking authority information can bypass strict Server Name Indication (SNI) validation. Affected versions are 11.0.20–11.0.24, 10.1.53–10.1.57, and 9.0.115–9.0.120. The corrected implementation requires each HTTP/2 request to supply authority information through either the :authority pseudo-header or the Host header.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can bypass strict SNI validation, undermining security policy enforced by that validation. The downstream consequences depend on the deployment's reliance on SNI checks. The vulnerability has a CNA CVSS v3.1 score of 9.8, although that rating alone does not establish a specific code-execution or data-access mechanism.
If you can’t patch tonight, do this now.
Until patched, restrict network access to affected HTTP/2 endpoints to trusted clients and minimize external exposure. These measures reduce exposure but do not correct the validation flaw. No vulnerability-specific interim workaround is documented.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121 or a later supported release in the corresponding branch. For vendor-packaged or embedded deployments, install the applicable vendor security update rather than independently replacing bundled components. Identified fixed application releases include Confluence 9.2.26, 10.2.19, and 11.0.0; Jira Service Management 10.3.25 and 11.3.11; and Red Hat JBoss Web Server 7.0.2.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.