Apache Tomcat has an improper input validation flaw stemming from an incomplete fix to a prior HTTP/2 no‑authority bypass issue. The vulnerability permits an attacker to craft HTTP/2 traffic that bypasses strict SNI validation, allowing requests to be directed at protected resources under TLS without the required domain matching. This flaw, classified as CWE‑20 and CWE‑444, could lead to confidentiality and integrity violations if an attacker can target applications that rely on SNI for resource isolation, although it does not directly enable remote code execution.

The vulnerability affects Apache Tomcat versions 9.0.115 through 9.0.120, 10.1.53 through 10.1.57, and 11.0.20 through 11.0.24. Affected deployments should verify their version and upgrade to the corresponding fixed releases 9.0.121, 10.1.58, or 11.0.25 to remediate the flaw.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but its classification as CWE‑20 and CWE‑444 and the ability to bypass server name indication suggest that the risk is high until a patch is applied. The CVSS score of 9.8 indicates critical severity. The attack vector is inferred to be remote and requires delivery of crafted HTTP/2 requests that exploit the incomplete validation logic. While no public exploits have been reported, the severity of uncontrolled input in a TLS context warrants immediate attention.