HTTP Request Smuggling Vulnerability in Apache Tomcat Packages
Summary
DEBIAN-CVE-2026-24880: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. Affects tomcat10 versions 10.1.10-1 – 10.1.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The affected versions of Tomcat include 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. This vulnerability can lead to serious security issues if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-24880 is an HTTP Request/Response Smuggling issue in Apache Tomcat, caused by inconsistent interpretation of HTTP requests due to invalid chunk extensions. This flaw could allow an attacker to smuggle requests or responses between a client and server, potentially leading to unauthorized access or data manipulation. It affects multiple versions of Tomcat, making it critical for users to address it immediately.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing a reverse proxy to filter and validate incoming requests to mitigate the risk of exploitation. Ensure that your application is configured to reject invalid chunked requests.
Conclusion
The HTTP Request Smuggling vulnerability in Apache Tomcat poses a significant risk to users of affected versions. It is crucial to upgrade to the patched versions to safeguard against potential attacks. Implementing workarounds can provide temporary relief, but a permanent fix through upgrading is strongly recommended.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2026-24880 is a vulnerability in Apache Tomcat that allows for HTTP Request/Response Smuggling due to inconsistent interpretation of HTTP requests.
The affected versions include Apache Tomcat 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability could allow attackers to manipulate requests and responses, potentially leading to unauthorized access to sensitive data or services.
If an immediate upgrade is not possible, consider implementing a reverse proxy to filter requests and validate incoming traffic to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
