---
title: "CVE-2026-65637"
source: https://dev.pageseeder.com/guide/security/advisories/cve-2026-65637.html
description: "CVE-2026-65637 is a Critical HTTP/2 SNI validation bypass in Apache Tomcat 9.0.115–9.0.120. PageSeeder exposure is configuration-dependent; the default Docker setup is unaffected, but custom HTTP/2 TLS configurations require verification and upgrade to Tomcat 9.0.121+."
last_updated: 2026-11-11T17:49:26+11:00
tokens: ~1222
---

# CVE-2026-65637


        *Apache Tomcat: HTTP/2 bypass of strict SNI validation*
      

| Property | Value |
| --- | --- |
| Published | 2026-08-25 |
| Last updated | 2026-11-11 |
| Component | Apache Tomcat |
| Severity | Critical |
| PageSeeder status | Not affected |

## Summary

An incomplete fix for CVE-2026-32990 allows an HTTP/2 request without authority to bypass strict server name indication (SNI) validation.

The issue affects Apache Tomcat 9.0.115 through 9.0.120 in the 9.0 branch and is fixed in Tomcat 9.0.121. The bundled version, 9.0.120, falls within this version range; exploitability depends on the conditions described below.

The Critical classification reflects the CISA assessment in the CVE record: 9.8 (CVSS 3.1). Apache rates this issue Moderate. The upstream severity is distinct from PageSeeder exposure.

For technical details, see the [Apache Tomcat security advisory](https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj).

## PageSeeder impact assessment

| Property | Value |
| --- | --- |
| Affected dependency | Apache Tomcat 9.0.120 (bundled) |
| PageSeeder versions assessed | Reviewed repository: 6.3003, bundling Tomcat 9.0.120; historical releases not independently assessed |
| Vulnerability status | Not affected |
| Conditions required for exploitation |  |
| Relevant PageSeeder configuration |  |
| Assessment date | 2026-11-11 |

### Assessment

PageSeeder is not affected by CVE-2026-65637 in its standard installer-generated and Docker configurations because Tomcat HTTP/2 is not enabled. Customised installations that enable HTTP/2 require a separate assessment.

Required conditions for exploitation: HTTP/2 over TLS terminating at Tomcat, with reliance on strict SNI validation; an HTTP/2 request without authority can bypass the intended validation.

Relevant PageSeeder configuration: Windows and Linux installers do not enable Tomcat HTTP/2. Windows and legacy EL7 Linux can configure HTTPS using Http11NioProtocol with clientAuth="false"; EL8/EL9 ship a plaintext HTTP/1.1 connector. Standard configurations do not meet the HTTP/2 prerequisite.

Evidence from source and configuration review:

- The supplied Docker configuration does not enable Tomcat TLS or HTTP/2.
- A reverse proxy offering HTTP/2 does not establish exposure unless the relevant TLS and HTTP/2 processing also occurs at Tomcat.
- Installer review confirms HTTP/1.1 connectors in windows/script/UpgradeFunctions.nsh (AddTomcatConnectors), linux/rpm/el7/includes/configure.sh and linux/rpm/el8/includes/bin/setup.sh (update\_connector). No Http2Protocol or UpgradeProtocol is added.
- Linux EL8 and EL9 packages share the EL8 connector configuration through linux/build.gradle. Their supplied server.xml enables plaintext HTTP/1.1 on port 8282.

This assessment is limited to the repository revision and configuration reviewed on 11 November 2026. It does not independently verify the historical PageSeeder version range in the model advisory. Customised connectors, deployment descriptors, extensions and additional web applications may change exposure.

The PageSeeder installer source was also reviewed at commit a08323b (Windows, Linux EL7, EL8 and EL9). Installer review supports the standard configuration assessment; it does not establish the configuration of every deployed server. Linux RPM packaging marks server.xml CONFIG | NOREPLACE, so existing administrator changes can survive upgrades.

## Recommended action

Administrators terminating HTTP/2 TLS at Tomcat and relying on strict SNI validation should upgrade to Tomcat 9.0.121 or later, preferably 9.0.123 or later. Disabling Tomcat HTTP/2 removes this prerequisite.

For installations matching the reviewed unaffected configuration, no CVE-specific emergency change is required. Confirm the installed configuration before relying on this conclusion. Use a supported PageSeeder distribution containing an updated Tomcat where available; this advisory does not announce a PageSeeder release date or confirm that such a distribution has shipped.

Dependency maintenance recommendation: update the bundled Tomcat to 9.0.123 or a later supported release, which also incorporates fixes for the other Critical CVEs covered in this advisory set.

> **Warning:** This assessment is based on source code and configuration review. It has not been verified through deployed server inspection or active exploit testing.

## References

- 
          [CVE-2026-65637 record and CISA severity assessment](https://www.cve.org/CVERecord?id=CVE-2026-65637)
        
- 
          [Apache Tomcat security advisory](https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj)
        
- 
          [Apache Tomcat 9 security advisories](https://tomcat.apache.org/security-9)
        
- 
          [Apache Tomcat 9 changelog](https://tomcat.apache.org/tomcat-9.0-doc/changelog.html)