Skip to main content

Apache Tomcat CVE-2026-24880

| EUVDEUVD-2026-21006 HIGH
HTTP Request/Response Smuggling (CWE-444)
2026-04-09 apache GHSA-563x-q5rq-57qp
Apache Information Disclosure Tomcat Request Smuggling Apache Tomcat Apache Software Foundation
High
Disputed · 7.5 Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send HTTP request with invalid chunk extension
  2. Exploit
    Tomcat parses request inconsistently
  3. Execution
    HTTP request smuggling occurs
  4. Impact
    Bypass security controls or poison cache

Vulnerability Assessment

Weakness
CWE
CWE-444
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
Exploitation Conditions

Remote unauthenticated attacker can exploit Apache Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.115, 10.1.0.M1-10.1.52, or 11.0.0.M1-11.0.18 via HTTP request with invalid chunk extension. No victim interaction required. Default configurations affected.
Impact

HTTP request smuggling via malformed chunk extensions in Tomcat can enable cache poisoning, session hijacking, or request interception on affected versions. CVSS 7.5 reflects high integrity impact; however, EPSS at 0.02% indicates low observed exploitation activity. Priority depends on deployment exposure: reverse-proxy setups and shared hosting face elevated risk. Patched versions available for all supported branches.
Exploit ScenarioDerived

Attacker sends crafted HTTP/1.1 request with invalid chunk extension to unauthenticated Tomcat endpoint. Request parsing inconsistency allows smuggling of second request past front-end proxy, poisoning cache or hijacking subsequent victim's session. No public exploit code identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

HTTP request smuggling in Apache Tomcat 7.x through 11.x permits unauthenticated remote attackers to manipulate request routing and bypass security controls via malformed chunk extension processing. Exploitation enables header injection, cache poisoning, and request routing manipulation without code execution. Affects Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.115, 10.1.0-M1-10.1.52, and 11.0.0-M1-11.0.18. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).

RemediationAI

Vendor-released patch: upgrade immediately to Apache Tomcat 11.0.20, 10.1.52, or 9.0.116 depending on deployment branch. For Tomcat 8.5.x and 7.x branches (end-of-life), migrate to supported versions 9.0.116+ or implement strict HTTP parsing via fronting reverse proxy with validated chunked encoding enforcement. Deploy Web Application Firewall rules blocking malformed chunk extensions as temporary mitigation. Verify intermediary proxy configurations for consistent HTTP/1.1 chunked encoding validation. Official advisory: https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn. Monitor NVD for updated guidance: https://nvd.nist.gov/vuln/detail/CVE-2026-24880

Affected VersionsENISA

Apache Tomcat 10.1.0-M1 ≤10.1.52
Apache Tomcat 7.0.0 ≤7.0.109
Apache Tomcat 11.0.0-M1 ≤11.0.18
Apache Tomcat 8.5.0 ≤8.5.100
Apache Tomcat 9.0.0.M1 ≤9.0.115

Affected Packages

maven org.apache.tomcat.embed:tomcat-embed-core fix: 9.0.116, 10.1.52, 11.0.20
maven org.apache.tomcat:tomcat fix: 9.0.116, 10.1.52, 11.0.20
maven org.apache.tomcat:tomcat-catalina fix: 9.0.116, 10.1.52, 11.0.20
maven org.apache.tomcat:tomcat-coyote fix: 9.0.116, 10.1.52, 11.0.20
maven org.apache.tomcat:tomcat-tribes fix: 9.0.116, 10.1.52, 11.0.20
euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-444 HTTP request smuggling through inconsistent chunk extension parsing. Tomcat's HTTP/1.1 chunked transfer encoding implementation fails to validate chunk extension syntax, allowing attackers to inject ambiguous requests that intermediary proxies and backend servers interpret differently. This desynchronization enables request boundary manipulation without requiring authentication (CVSS PR:N).

Know when Apache Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (apache) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE HIGH
Red Hat 4.3 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Apr 11, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 09, 2026 - 19:12 nvd
HIGH 7.5

DescriptionCVE.org

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 14 maven packages depend on org.apache.tomcat:tomcat-catalina (13 direct, 1 indirect)

Ecosystem-wide dependent count for version 7.0.0.

Executive ViewAI

Why It Matters

Apache Tomcat versions 7 through 11 contain an HTTP request smuggling vulnerability that allows unauthenticated attackers to manipulate request routing and bypass security controls, potentially enabling cache poisoning and header injection attacks. Organizations running affected Tomcat instances face risk of request manipulation that could compromise application security posture and cache integrity without requiring authentication or exploitation tools currently in public circulation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy WAF rules to reject malformed HTTP chunk extensions and filter suspicious Content-Length/Transfer-Encoding headers; (2) Disable HTTP/1.1 chunked transfer encoding if operationally feasible and use HTTP/2 or upgrade to patched version; (3) Implement request validation at reverse proxy/load balancer to normalize and validate HTTP request structure before reaching Tomcat; (4) Monitor access logs for malformed chunk extension patterns and anomalous request routing behavior; (5) Isolate affected Tomcat instances from untrusted networks pending patch deployment. Monitor vendor advisory channels for patch release timeline.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Apache Tomcat

View all
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2026-29146 HIGH POC
7.5 Apr 09

Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7
CVE-2026-50229 MEDIUM POC
6.1 Jun 29

Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script in
CVE-2026-76183 CRITICAL
9.8 Sep 23

Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are sup
CVE-2026-43512 CRITICAL
9.8 May 12

Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP
CVE-2026-41293 CRITICAL
9.8 May 12

Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, a
CVE-2026-29145 CRITICAL
9.1 Apr 09

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote at
CVE-2026-43515 CRITICAL
9.1 May 12

Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 1
CVE-2026-103119 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current re
CVE-2026-101356 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.22-11.0.26, 10.1.55-10.1.60, and 9.0.118-9.0.122 contain an object-recycling race in HTTP/2 processin
CVE-2026-101296 CRITICAL
9.1 Oct 20

Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid pa
CVE-2026-86350 CRITICAL
9.1 Sep 23

HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticate

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-88773 CRITICAL POC
9.3
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2021-23336 MEDIUM POC
5.9
CVE-2025-55315 CRITICAL POC
9.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-24880 ADVISORY https://vuldb.com/vuln/356654 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-24880 REF http://www.openwall.com/lists/oss-security/2026/04/09/20

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy