Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation

Fix availableCritical · CVSS 9.8EPSS 0.61%

Published Aug 26, 2026 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: org.apache.tomcat:tomcat-coyote 11.0.25, org.apache.tomcat:tomcat-coyote 10.1.59, org.apache.tomcat:tomcat-coyote 9.0.121, org.apache.tomcat.embed:tomcat-embed-core 11.0.25 (see table).
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.tomcat:tomcat-coyote

Vulnerable versions
>= 11.0.20, < 11.0.25
Fixed in
11.0.25

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-coyote

Mavenorg.apache.tomcat:tomcat-coyote

Vulnerable versions
>= 10.1.53, <= 10.1.57
Fixed in
10.1.59

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-coyote

Mavenorg.apache.tomcat:tomcat-coyote

Vulnerable versions
>= 9.0.115, < 9.0.121
Fixed in
9.0.121

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-coyote

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 11.0.20, < 11.0.25
Fixed in
11.0.25

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 10.1.53, <= 10.1.57
Fixed in
10.1.59

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 9.0.115, < 9.0.121
Fixed in
9.0.121

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Sources

CWE-20 Improper Input Validation

← All critical vulnerabilities