CVE-2025-66614

Aliases:GHSA-fpj8-gq4v-p354BIT-tomcat-2025-66614UBUNTU-CVE-2025-66614DEBIAN-CVE-2025-66614
Advisory lineage Upstream: 0 Downstream: 28
Modified
Published: 17 Feb 2026, 18:48
Last modified:24 Mar 2026, 09:46

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (nvd)
EPSS Score
0.24% LOW
0% probability +0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Feb 2026, 18:48
Published
Vulnerability first disclosed
24 Mar 2026, 09:46
Last Modified
Vulnerability information updated

Description

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • v3.1•HIGH•Score: 7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS Trends

Current EPSS score: 0.24%• Percentile: 15%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • apache software foundation•apache tomcat

    ≥ 11.0.0-M1, ≤ 11.0.14 | ≥ 10.1.0-M1, ≤ 10.1.49 | ≥ 9.0.0-M1, ≤ 9.0.112 | ≥ 8.5.0, ≤ 8.5.100

  • apache•tomcat

    ≥ 9.0.1, < 9.0.113 | ≥ 10.1.1, < 10.1.50 | ≥ 11.0.1, < 11.0.15 | 9.0.0:milestone1 | 9.0.0:milestone10 | 9.0.0:milestone11 | 9.0.0:milestone12 | 9.0.0:milestone13 | 9.0.0:milestone14 | 9.0.0:milestone15 | 9.0.0:milestone16 | 9.0.0:milestone17 | 9.0.0:milestone18 | 9.0.0:milestone19 | 9.0.0:milestone2 | 9.0.0:milestone20 | 9.0.0:milestone21 | 9.0.0:milestone22 | 9.0.0:milestone23 | 9.0.0:milestone24 | 9.0.0:milestone25 | 9.0.0:milestone26 | 9.0.0:milestone27 | 9.0.0:milestone3 | 9.0.0:milestone4 | 9.0.0:milestone5 | 9.0.0:milestone6 | 9.0.0:milestone7 | 9.0.0:milestone8 | 9.0.0:milestone9 | 10.1.0:milestone1 | 10.1.0:milestone10 | 10.1.0:milestone11 | 10.1.0:milestone12 | 10.1.0:milestone13 | 10.1.0:milestone14 | 10.1.0:milestone15 | 10.1.0:milestone16 | 10.1.0:milestone17 | 10.1.0:milestone18 | 10.1.0:milestone19 | 10.1.0:milestone2 | 10.1.0:milestone20 | 10.1.0:milestone3 | 10.1.0:milestone4 | 10.1.0:milestone5 | 10.1.0:milestone6 | 10.1.0:milestone7 | 10.1.0:milestone8 | 10.1.0:milestone9 | 11.0.0:milestone1 | 11.0.0:milestone10 | 11.0.0:milestone11 | 11.0.0:milestone12 | 11.0.0:milestone13 | 11.0.0:milestone14 | 11.0.0:milestone15 | 11.0.0:milestone16 | 11.0.0:milestone17 | 11.0.0:milestone18 | 11.0.0:milestone19 | 11.0.0:milestone2 | 11.0.0:milestone20 | 11.0.0:milestone21 | 11.0.0:milestone22 | 11.0.0:milestone23 | 11.0.0:milestone24 | 11.0.0:milestone25 | 11.0.0:milestone26 | 11.0.0:milestone3 | 11.0.0:milestone4 | 11.0.0:milestone5 | 11.0.0:milestone6 | 11.0.0:milestone7 | 11.0.0:milestone8 | 11.0.0:milestone9

  • debian•tomcat10

    < 10.1.52-1~deb12u1 | < 10.1.52-1~deb13u1 | < 10.1.52-1

  • debian•tomcat11

    < 11.0.15-1~deb13u1 | < 11.0.15-1

  • debian•tomcat9

    < 9.0.70-2 | < 9.0.70-2 | < 9.0.70-2 | < 9.0.70-2

  • ubuntu•tomcat10

    all | all | all

  • ubuntu•tomcat11

    all

  • ubuntu•tomcat8

    all

  • ubuntu•tomcat9

    all | all | all

  • org.apache.tomcat•tomcat

    ≥ 11.0.0-M1, < 11.0.14 | ≥ 10.1.0-M1, < 10.1.49 | < 9.0.112 | ≥ 11.0.0-M1, < 11.0.15 | ≥ 10.1.0-M1, < 10.1.50 | < 9.0.113

  • org.apache.tomcat•tomcat-catalina

    ≥ 11.0.0-M1, < 11.0.14 | ≥ 10.1.0-M1, < 10.1.49 | < 9.0.112 | ≥ 11.0.0-M1, < 11.0.15 | ≥ 10.1.0-M1, < 10.1.50 | < 9.0.113

  • org.apache.tomcat•tomcat-coyote

    ≥ 11.0.0-M1, < 11.0.15 | ≥ 10.1.0-M1, < 10.1.50 | < 9.0.113

  • org.apache.tomcat.embed•tomcat-embed-core

    ≥ 11.0.0-M1, < 11.0.14 | ≥ 10.1.0-M1, < 10.1.49 | < 9.0.112 | ≥ 11.0.0-M1, < 11.0.15 | ≥ 10.1.0-M1, < 10.1.50 | < 9.0.113

References (15)