CVE-2026-24880: Apache Tomcat HTTP request smuggling via invalid chunk extension

Executive brief

Apache Tomcat, a widely used web server for Java applications, is vulnerable to a request smuggling flaw. This allows an attacker to send specially crafted web requests that are misinterpreted by the server, potentially bypassing security controls or interfering with other users' sessions. Organizations should update to the latest patched versions to prevent unauthorized modification of web traffic.

Technical details

An HTTP Request/Response Smuggling vulnerability (CWE-444) exists in Apache Tomcat due to the inconsistent interpretation of HTTP requests containing invalid chunk extensions. By sending a malformed request, a remote, unauthenticated attacker can cause Tomcat to misinterpret the message boundaries. This can lead to request smuggling when Tomcat is used behind a proxy, allowing an attacker to bypass security constraints or poison web caches. The issue is fixed in versions 11.0.20, 10.1.52, and 9.0.116.

Affected products

• Apache Tomcat 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, 7.0.0 through 7.0.109

Timeline

• 2026-04-09: disclosed
• 2026-04-09: advisory

References

• https://api.github.com/users/tkwilli94
• https://github.com/tkwilli94
• https://api.github.com/users/tkwilli94/gists%7B/gist_id%7D
• https://api.github.com/users/tkwilli94/repos
• https://avatars.githubusercontent.com/u/14239808?v=4
• https://api.github.com/users/tkwilli94/events%7B/privacy%7D