GHSA-563x-q5rq-57qp
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2026-24880
- Aliases
- BIT-tomcat-2026-24880
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat-coyote | introduced 7.0.0, fixed 9.0.116 |
| Maven · org.apache.tomcat:tomcat-coyote | introduced 10.1.0-M1, fixed 10.1.52 |
| Maven · org.apache.tomcat:tomcat-coyote | introduced 11.0.0-M1, fixed 11.0.20 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 7.0.0, fixed 9.0.116 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 10.1.0-M1, fixed 10.1.52 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 11.0.0-M1, fixed 11.0.20 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-24880 ADVISORY
- https://github.com/apache/tomcat/commit/1b586d6aa8ae65726da5fa8799427b5d4718478a WEB
- https://github.com/apache/tomcat/commit/1e71441a15972f56e661b0b549fb9e5d838b83bb WEB
- https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5 WEB
- https://github.com/apache/tomcat/commit/6d478dbe18b7c4bb671c30fedf130309b0dab77c WEB
- https://github.com/apache/tomcat/commit/f07df938d00f7419b40fa65aa912966d0efac522 WEB
- https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn WEB
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53 WEB
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20 WEB
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116 WEB
- https://www.herodevs.com/vulnerability-directory/cve-2026-24880 WEB
- http://www.openwall.com/lists/oss-security/2026/04/09/20 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |