<reportApi _class='io.jenkins.plugins.analysis.core.restapi.ReportApi'><issue><addedAt>0</addedAt><authorEmail>-</authorEmail><authorName>-</authorName><baseName>catalina.jar</baseName><category></category><columnEnd>0</columnEnd><columnStart>0</columnStart><commit>-</commit><description></description><fileName>/usr/local/tomcat/lib/catalina.jar</fileName><fingerprint>FALLBACK-f899c988</fingerprint><lineEnd>1</lineEnd><lineStart>1</lineStart><message>CVE-2026-32990: LanguageSpecificPackageVulnerability

Improper Input Validation vulnerability in Apache Tomcat due to an inc ...

For additional help see: **Vulnerability CVE-2026-32990**
| Severity | Package | Fixed Version | Link |
| --- | --- | --- | --- |
|MEDIUM|org.apache.tomcat:tomcat-catalina|9.0.116, 10.1.53, 11.0.20|[CVE-2026-32990](https://avd.aquasec.com/nvd/cve-2026-32990)|

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Package: org.apache.tomcat:tomcat-catalina
Installed Version: 9.0.115
Vulnerability CVE-2026-32990
Severity: MEDIUM
Fixed Version: 9.0.116, 10.1.53, 11.0.20
Link: [CVE-2026-32990](https://avd.aquasec.com/nvd/cve-2026-32990)</message><moduleName></moduleName><origin>trivy</origin><originName>Trivy Security Scanner</originName><packageName>-</packageName><reference>1398</reference><severity>NORMAL</severity><toString>catalina.jar(1,0): CVE-2026-32990: : CVE-2026-32990: LanguageSpecificPackageVulnerability

Improper Input Validation vulnerability in Apache Tomcat due to an inc ...

For additional help see: **Vulnerability CVE-2026-32990**
| Severity | Package | Fixed Version | Link |
| --- | --- | --- | --- |
|MEDIUM|org.apache.tomcat:tomcat-catalina|9.0.116, 10.1.53, 11.0.20|[CVE-2026-32990](https://avd.aquasec.com/nvd/cve-2026-32990)|

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Package: org.apache.tomcat:tomcat-catalina
Installed Version: 9.0.115
Vulnerability CVE-2026-32990
Severity: MEDIUM
Fixed Version: 9.0.116, 10.1.53, 11.0.20
Link: [CVE-2026-32990](https://avd.aquasec.com/nvd/cve-2026-32990)</toString><type>CVE-2026-32990</type></issue><size>1</size><toString>1 warning (normal: 1)</toString></reportApi>