This vulnerability stems from an incomplete fix applied to a prior issue (CVE-2025-66614). The improper input validation allows crafted requests to the Tomcat server to potentially manipulate internal data structures or trigger abnormal behavior. The weakness corresponds to identified CWEs indicating unsafe handling of input sizes and boundary checks, increasing the likelihood of successful exploitation if an attacker can supply malicious input.

The affected product is Apache Tomcat, specifically versions from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, and from 9.0.113 through 9.0.115. These releases are distributed by the Apache Software Foundation and are commonly used in enterprise Java web applications.

The CVSS score of 5.3 places the vulnerability in the medium range, while an EPSS score of less than 1% indicates a low probability of exploitation at present. It is not listed in the CISA KEV catalog, suggesting no known widespread attacks. The likely attack vector is through HTTP requests sent to the Tomcat server, where malicious input could be crafted to trigger the improper input handling. The risk remains moderate until the product is upgraded to the patched releases listed in the advisory.