CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension
Attackers can exploit HTTP request smuggling via invalid chunk extensions in Apache Tomcat, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24880?
CVE-2026-24880 is a high-severity vulnerability in Apache Tomcat, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
Weakness: CWE-444
Which versions are affected by CVE-2026-24880?
13 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.52 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.52 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 9.0.116 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 9.0.116 |
7 more packages
tomcat Bitnami | All versions | 9.0.116, 10.1.53, 11.0.20 |
org.apache.tomcat:tomcat-coyote Maven | From 10.1.0-M1 | 10.1.52 |
org.apache.tomcat:tomcat-coyote Maven | From 10.1.0-M1 | 10.1.52 |
org.apache.tomcat:tomcat-coyote Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat:tomcat-coyote Maven | From 11.0.0-M1 | 11.0.20 |
org.apache.tomcat:tomcat-coyote Maven | From 7.0.0 | 9.0.116 |
org.apache.tomcat:tomcat-coyote Maven | From 7.0.0 | 9.0.116 |
Products include Apache Tomcat.
How do I fix CVE-2026-24880?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.52, 11.0.20 or 9.0.116.
Is CVE-2026-24880 being exploited?
There is no known exploitation of CVE-2026-24880 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-24880, CLEANSTART-2026-PK48524, CLSA-2026-1778546710, CLSA-2026-1778633134, DEBIAN-CVE-2026-24880, GHSA-563x-q5rq-57qp and 8 more.