CVE-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Attackers can cause request failures for other users via HTTP request smuggling when Tomcat is behind a reverse proxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77756?
CVE-2026-77756 is a low-severity vulnerability in Apache Tomcat, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Weakness: CWE-444
Which versions are affected by CVE-2026-77756?
1 open source package ship an affected version, including tomcat.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | From 8.5.67 | 9.0.45, 9.0.122, 10.1.60, 11.0.26 |
How do I fix CVE-2026-77756?
Upgrade tomcat to a fixed version for your release line: 9.0.45, 9.0.122, 10.1.60 or 11.0.26.
Is CVE-2026-77756 being exploited?
There is no known exploitation of CVE-2026-77756 in the wild and no public exploit code.
Sources
Also known as BIT-tomcat-2026-77756, DEBIAN-CVE-2026-77756, GHSA-gpfr-7w77-mp48, MINI-j72f-7557-v57c, MINI-m2wv-j99f-26xf, MINI-w6v5-g8rj-5h9v and 1 more.