CVE-2026-24880: Apache Tomcat: Request smuggling via invalid chunk extension
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.20 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.52 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.116
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24880?
CVE-2026-24880 has a medium severity level affecting Apache Tomcat due to potential HTTP request smuggling.
How do I fix CVE-2026-24880?
To fix CVE-2026-24880, upgrade Apache Tomcat to versions 11.0.19, 10.1.53, 9.0.116, or later.
Which versions of Apache Tomcat are affected by CVE-2026-24880?
CVE-2026-24880 affects Apache Tomcat versions from 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, and earlier versions down to 7.0.0.
What kind of vulnerability is CVE-2026-24880?
CVE-2026-24880 is an HTTP request smuggling vulnerability due to inconsistent interpretation of requests via invalid chunk extensions.
Is CVE-2026-24880 present in the latest Apache Tomcat release?
No, CVE-2026-24880 has been addressed in the latest releases of Apache Tomcat, thus it is not present in versions after the recommended upgrades.