Improper Input Validation in Apache Tomcat Affects Multiple Versions

CVE-2025-66614

What is CVE-2025-66614?

An improper input validation vulnerability exists in Apache Tomcat, which affects specific versions. This issue arises when the host name provided via the SNI extension differs from the host name in the HTTP host header field. In configurations with multiple virtual hosts, if certificate authentication is not consistently applied, it can be possible for clients to evade security measures by manipulating these fields. This primarily affects configurations where certificate authentication is enforced at the Connector level but not at the web application level. To mitigate risks, users should upgrade to versions 11.0.15, 10.1.50, or 9.0.113 and above.

References