CVE-2026-24880
Last modified
CVE-2026-24880 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 9.0.0, < 9.0.116 |
| Apache | Tomcat | >= 10.1.0, < 10.1.53 |
| Apache | Tomcat | >= 11.0.0, < 11.0.20 |
References
- https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5snMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/09/20Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-24880?
How severe is CVE-2026-24880?
How do I fix CVE-2026-24880?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-24871Improper Control of Generation of Code ('Code Injection') vu…10
- CVE-2026-24872improper pointer arithmetic vulnerability in ProjectSkyfir…9.8
- CVE-2026-24873Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.…7.8
- CVE-2026-24874Access of Resource Using Incompatible Type ('Type Confusion'…9.1
- CVE-2026-24875Integer Overflow or Wraparound vulnerability in yoyofr modiz…7.8
- CVE-2026-2488The ProfileGrid – User Profiles, Groups and Communities plug…4.3
- CVE-2026-24881In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData…9.8
- CVE-2026-24882In GnuPG before 2.5.17, a stack-based buffer overflow exists…7.8
- CVE-2026-24883In GnuPG before 2.5.17, a long signature packet length cause…5.5
- CVE-2026-24884Compressing is a compressing and uncompressing lib for node.…7.8
- CVE-2026-24885Kanboard is project management software focused on Kanban me…8
- CVE-2026-24887Claude Code is an agentic coding tool. Prior to version 2.0.…8.8
Are you affected by CVE-2026-24880?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST