SB2026021765 - Multiple vulnerabilities in Apache Tomcat

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026021765

SB2026021765 - Multiple vulnerabilities in Apache Tomcat

Published: February 17, 2026 Updated: February 18, 2026

Security Bulletin ID SB2026021765
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Protection mechanism failure (CVE-ID: CVE-2026-24733)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures when handling HTTP/0.9 requests. If the server is configured to allow HEAD requests to a URI but deny GET requests, an attacker can bypass that constraint on GET requests by sending a (specification invalid) HEAD request.


2) Improper authorization (CVE-ID: CVE-2025-66614)

The vulnerability allows a remote attacker to bypass client certificate verification.

The vulnerability exists due to Tomcat does not validate that the host name provided via the SNI extension is the same as the host name provided in the HTTP host header field. If there is more than one virtual host configured and the TLS configuration for one of those hosts does not require client certificate authentication, it is possible for a client to bypass the client certificate authentication for the target host by sending different host names in the SNI extension and the HTTP host header field.


Remediation

Install update from vendor's website.

References