CVE-2025-66614

Overview

Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications. 

‍

An Improper Input Validation vulnerability (CVE-2025-66614) has been identified in Apache Tomcat where Tomcat does not validate that the host name provided via the SNI extension is the same as the host name provided in the HTTP host header field.

‍

An Improper Input Validation vulnerability occurs when a product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

‍

This issue affects multiple versions of Apache Tomcat below 11.0.15.

‍

Details

Module Info

• Product: Apache Tomcat
• Affected packages: tomcat, tomcat-coyote
• Affected versions: >=8.5.0 <=8.5.100, >=9.0.0.M1 <9.0.113, >=10.1.0-M1 <10.1.50, >=11.0.0-M1 <=11.0.15
• GitHub repository: https://github.com/apache/tomcat

• Published packages:
  
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-coyote

• Package manager: Maven
• Fixed in: NES for Tomcat 8.5.104

‍

Vulnerability Info

If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

‍

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

‍

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• An external security researcher

‍