> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Apache Tomcat HTTP/2 SNI bypass CVE-2026-32990 patched in latest releases - URL: https://f4n6.co.uk/security-feed/apache-tomcat-http-2-sni-bypass-cve-2026-32990-patched-in-latest-releases/ - Published: 2026-10-27T15:37:01.000Z - Updated: 2026-10-27T15:37:01.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-32990 ## 1\. Executive summary Apache Tomcat contains an improper input validation flaw, CVE-2026-32990, that lets an HTTP/2 client omit the `:authority` pseudo-header and bypass strict SNI hostname validation. NVD scores it CVSS 5.3 MEDIUM (CWE-20). It is not listed in CISA KEV and EPSS records 0% exploitation probability. The flaw is an incomplete fix for an earlier issue and affects Tomcat 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120; fixed releases are 11.0.25, 10.1.59 and 9.0.121\. The GitHub advisory labels the issue "Critical severity" while NVD scores it 5.3 MEDIUM; this advisory uses the NVD value. For EMEA financial services the exposure is concentrated in estates that terminate TLS on Tomcat and rely on SNI to route or isolate tenants, where the bypass can defeat virtual-host separation. The absence of KEV listing and the 0% EPSS score mean this is a scheduled-patch item, not an emergency. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24 | A production web-tier component (Tomcat) carries a validation flaw that defeats a security control (strict SNI validation) and requires a version upgrade to remediate | Digital operational resilience testing should confirm whether SNI-based virtual-host separation is in use and whether the bypass is reachable in the tested configuration | | DORA Art. 28 | Tomcat is a third-party ICT component embedded in client-facing and internal applications, and remediation depends on the upstream Apache release cadence | Third-party risk records should capture the affected version, the fixed version, and the upgrade dependency on the Apache project | No NIS2 or UK NIS 2018 article is directly engaged by this item. ## 3\. Technical analysis & attack chain CVE-2026-32990 is an improper input validation flaw in Apache Tomcat's HTTP/2 handling. The advisory title describes it as a "no-authority bypass of strict SNI validation", and the description states it is an incomplete fix for an earlier CVE-2026-32990 issue. The mechanism, as far as the sources state it, is that an HTTP/2 request that omits the `:authority` pseudo-header is not correctly validated against the strict SNI hostname check, so a client can reach a virtual host or TLS context that strict SNI validation was meant to prevent. Confirmed steps, limited to what the sources support: 1. The attacker sends an HTTP/2 request to a Tomcat instance running an affected version (11.0.20 to 11.0.24, 10.1.53 to 10.1.57, or 9.0.115 to 9.0.120). 2. The request omits the `:authority` pseudo-header. 3. Tomcat's strict SNI validation does not reject the request, and the request is processed against a host context the operator intended to isolate. The sources do not describe post-bypass impact beyond the advisory's risk categories. The ANSSI CERT-FR bulletin covering the October 2026 Tomcat patch cycle lists "atteinte à la confidentialité des données" (loss of data confidentiality) and "contournement de la politique de sécurité" (security policy bypass) among the risks for the set of vulnerabilities it covers, but it does not attribute either risk to CVE-2026-32990 specifically. Treat any confidentiality impact as unconfirmed for this CVE. Affected and fixed versions: | Branch | Affected | Fixed | | ------ | ----------------------- | ------- | | 11.0.x | 11.0.20 through 11.0.24 | 11.0.25 | | 10.1.x | 10.1.53 through 10.1.57 | 10.1.59 | | 9.0.x | 9.0.115 through 9.0.120 | 9.0.121 | The GitHub advisory's affected-version ranges are stated as ">= 11.0.20, < 11.0.25", ">= 10.1.53, <= 10.1.57" and ">= 9.0.115, < 9.0.121", which match the prose ranges above. Discrepancy to note: the GitHub advisory header labels the issue "Critical severity", while NVD scores it CVSS 5.3 MEDIUM. This advisory uses the NVD value. The GitHub advisory also states the flaw is an "incomplete fix for CVE-2026-32990", which is self-referential; the earlier CVE it refers to is not identified in the sources and should be confirmed against the Apache Tomcat security pages before relying on it. The ANSSI CERT-FR bulletin CERTFR-2026-AVI-1358 (21 October 2026) covers a broader set of Tomcat vulnerabilities fixed in 10.1.61, 11.0.27 and 9.0.123, which are later than the fixed versions named for CVE-2026-32990\. Clients who upgrade to the ANSSI-recommended versions will also be clear of CVE-2026-32990\. The bulletin does not name CVE-2026-32990 among its CVE references, so it is not corroboration of this specific flaw; it is context on the surrounding patch cycle. No exploitation in the wild, no actor attribution, and no malware capability are described in any source. There is no MITRE ATT&CK technique mapping for this item. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every Tomcat deployment and record the exact version. Check `$CATALINA_HOME/lib/catalina.jar` manifest or the `Server` response header, and confirm against the affected ranges above. - Identify any Tomcat instance that terminates TLS and uses SNI to route or isolate virtual hosts or tenants. These are the instances where the bypass has operational consequence. Where such an instance cannot be patched immediately, disable HTTP/2 on its connector (remove the `` element from the connector in `conf/server.xml`) and restart Tomcat. P2 (within 72 hours) - Upgrade to 11.0.25, 10.1.59 or 9.0.121, or to the later ANSSI-recommended versions 11.0.27, 10.1.61 or 9.0.123 if the estate is already tracking that patch cycle. Test in a staging environment that exercises the SNI virtual-host configuration before production rollout. - Where an application cannot move off an affected version, front the Tomcat instance with a reverse proxy that enforces the `:authority` header on HTTP/2 requests, and confirm the proxy rejects requests that omit it. P3 (within 7 days) - Add a configuration check to the build or deployment pipeline that fails if a Tomcat version in the affected ranges is deployed. - Review whether any application relies on SNI-based isolation as a security boundary. If it does, document that the boundary depends on the Tomcat version and add a compensating control at the network layer. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe a protocol-level behaviour (HTTP/2 request with no `:authority` pseudo-header) but give no atomic indicators, no hashes, no hostnames, and no log excerpts. The behavioural indicator below is derived from the advisory title and description; it is single-sourced to the GitHub advisory and should be validated against a test instance before it is used for alerting. ### Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------- | ------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | | HTTP/2 request received with no :authority pseudo-header | Tomcat access logs and HTTP/2 frame captures at the TLS terminator | Low (single-sourced; derived from advisory title, not from a published packet capture) | ## 6\. Detection The sources contain no file artefacts, command-line strings, mutex names, registry keys or hard-coded values. A YARA rule cannot be written from this material without fabricating strings. A Sigma rule can be written against the behavioural indicator, but it depends on the HTTP/2 request being logged with the pseudo-header visible. Standard Tomcat access logs do not record `:authority`; the rule below assumes a front proxy or a custom valve that logs the header. Validate the field name against the client's logging pipeline before deployment. ```yaml title: HTTP/2 request to Tomcat with missing authority pseudo-header id: 8f3c2a10-6b7e-4d21-9c55-0a1e7d4b9f62 status: experimental description: Detects HTTP/2 requests that omit the :authority pseudo-header, the condition described in CVE-2026-32990 for bypassing strict SNI validation in Apache Tomcat. Requires a logging source that records HTTP/2 pseudo-headers. author: Adverse Trace date: 2026-10-27 references: - https://github.com/advisories/GHSA-f525-44xv-f2qj logsource: category: webserver detection: selection_proto: protocol|contains: 'HTTP/2' selection_missing_authority: authority: null filter_healthcheck: user_agent|contains: - 'kube-probe' - 'ELB-HealthChecker' condition: selection_proto and selection_missing_authority and not filter_healthcheck falsepositives: - Health checkers and load balancers that send HTTP/2 without an authority header - Clients using HTTP/2 connection coalescing level: medium ``` ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-32990](https://nvd.nist.gov/vuln/detail/CVE-2026-32990?ref=f4n6.co.uk) | 5.3 Medium | — | 0% | Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614\. This issue affects Apache… | ## 7\. Sources - GitHub Advisory Database, "Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation" (GHSA-f525-44xv-f2qj), published 2026-08-26, updated 2026-10-27\. https://github.com/advisories/GHSA-f525-44xv-f2qj - ANSSI CERT-FR, "Multiples vulnérabilités dans Apache Tomcat" (CERTFR-2026-AVI-1358), 21 October 2026\. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1358/ - ANSSI CERT-FR, "Multiples vulnérabilités dans Apache Tomcat" (CERTFR-2026-AVI-0876), 15 July 2026\. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0876/ - GitHub Advisory Database, "Improper Authentication vulnerability in Apache Tomcat" (GHSA-5q6q-ffrq-6xfc). https://github.com/advisories/GHSA-5q6q-ffrq-6xfc - GitHub Advisory Database, "Apache Tomcat Missing Encryption of Sensitive Data vulnerability" (GHSA-69r9-qgr7-g2wj). https://github.com/advisories/GHSA-69r9-qgr7-g2wj - GitHub Advisory Database, "Apache Tomcat Improper Input Validation vulnerability" (GHSA-fccv-jmmp-qg76). https://github.com/advisories/GHSA-fccv-jmmp-qg76 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-32990 as CVSS 5.3 MEDIUM, not in CISA KEV, with EPSS at 0%. The GitHub advisory's "Critical severity" label is not supported by the NVD score and we do not adopt it. The practical risk to a financial services client depends on one configuration fact: whether Tomcat terminates TLS and uses SNI to separate virtual hosts or tenants. Where it does, the bypass defeats a security boundary and the instance should be patched or have HTTP/2 disabled within 24 hours. Where it does not, this is a routine patch-cycle item. No actor attribution is possible from the sources; none is offered. We will track the Apache Tomcat security pages for the CVE reference behind the "incomplete fix" wording and update this advisory if the earlier CVE is identified or if exploitation is reported. Clients should confirm their Tomcat inventory and SNI configuration against the P1 steps and report back the affected instance count. --- [Read the original source →](https://github.com/advisories/GHSA-f525-44xv-f2qj?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*