CVE-2026-24880: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

CVE-2026-24880 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache Tomcat, a widely used web server for Java applications, is vulnerable to a request smuggling flaw. This allows an attacker to send specially crafted web requests that are misinterpreted by the server, potentially bypassing security controls or interfering with other users' sessions. Organizations should update to the latest patched versions to prevent unauthorized modification of web traffic.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-24880 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24880 being exploited in the wild.
How severe is CVE-2026-24880?
High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?
org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=7.0.0,fixed=9.0.116; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=7.0.0,fixed=9.0.116.
Is there a fix for CVE-2026-24880?
Yes. org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.116 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.116 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24880 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-24880?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat:tomcat-coyote to 9.0.116 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 9.0.116 in your pom.xml or build.gradle

Technical details

An HTTP Request/Response Smuggling vulnerability (CWE-444) exists in Apache Tomcat due to the inconsistent interpretation of HTTP requests containing invalid chunk extensions. By sending a malformed request, a remote, unauthenticated attacker can cause Tomcat to misinterpret the message boundaries. This can lead to request smuggling when Tomcat is used behind a proxy, allowing an attacker to bypass security constraints or poison web caches. The issue is fixed in versions 11.0.20, 10.1.52, and 9.0.116.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, 7.0.0 through 7.0.109

Identifiers

  • CVE-2026-24880
  • GHSA-563x-q5rq-57qp

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.