cve-2026-24880

{
  "advisories": [
    {
      "id": "GHSA-563x-q5rq-57qp",
      "source": "ghsa",
      "title": "Apache Tomcat has an HTTP Request/Response Smuggling vulnerability",
      "url": "https://github.com/advisories/GHSA-563x-q5rq-57qp"
    },
    {
      "id": "DLA-4619-1",
      "source": "dla",
      "title": "tomcat9 security update",
      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00008.html"
    },
    {
      "id": "DSA-6328-1",
      "source": "dsa",
      "title": "tomcat10 security update",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00239.html"
    },
    {
      "id": "DSA-6329-1",
      "source": "dsa",
      "title": "tomcat11 security update",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00240.html"
    }
  ],
  "cve": "CVE-2026-24880",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[11.0.0-M1,11.0.18]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[10.1.0-M1,10.1.52]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[9.0.0.M1,9.0.115]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[8.5.0,8.5.100]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[7.0.0,7.0.109]"
            }
          }
        ],
        "enrichment": {
          "confidence": 95.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 95.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Apache Tomcat",
          "source": "cna",
          "vendor": "Apache Software Foundation"
        },
        "product": "tomcat",
        "vendor": "apache"
      }
    ],
    "analysis": {
      "en": {
        "generated_at": "2026-04-14T23:35:31.964170+00:00",
        "value": {
          "mitigation_remediation": [
            "Apply the vendor patch to upgrade to Tomcat 11.0.20, 10.1.52, or 9.0.116, the releases that contain the fixed logic.",
            "If an upgrade is not immediately feasible, reduce exposure by restricting Tomcat to trusted internal networks or interfaces and block external traffic that is not strictly required.",
            "Implement a WAF or IDS rule configured to detect and reject malformed HTTP chunk extensions, thereby mitigating request smuggling attempts while the fix is pending."
          ],
          "summary": {
            "action": "Immediate Patch",
            "impact": "HTTP Request Smuggling"
          },
          "threat_synthesis": {
            "affected_systems": "Affected products are Apache Tomcat from the Apache Software Foundation. Vulnerable releases cover Tomcat 11.0.0‑M1 through 11.0.18, 10.1.0‑M1 through 10.1.52, 9.0.0‑M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109; older or unsupported releases may also be impacted.",
            "description_and_impact": "Tomcat versions 7 through 11 intentionally accept HTTP requests that contain an improperly formed chunk extension and process the boundaries of the request differently than expected. This ambiguity enables an attacker to smuggle a second request into the same connection, potentially allowing the attacker to bypass access controls, extract sensitive data, or redirect traffic. The flaw is classified as CWE‑444, indicating an inconsistency in HTTP request/response handling.",
            "risk_and_exploitability": "The CVSS base score of 7.5 marks the bug as high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation observed in the wild. The vulnerability is not cataloged in CISA's KEV database. Based on the description, it is inferred that attacks likely proceed over HTTP from a remote client, do not require prior authentication, and rely on the transmission of a crafted request that includes a malformed chunk extension to a Tomcat instance exposed to the internet."
          }
        }
      }
    },
    "created": "2026-04-10T08:39:00.395478+00:00",
    "updated": "2026-04-15T16:00:07.801031+00:00",
    "vendors": [
      "apache",
      "apache$PRODUCT$tomcat"
    ]
  },
  "epss": {
    "score": 0.00709
  },
  "mitre": {
    "cpes": [],
    "created": "2026-04-09T19:12:10.730000+00:00",
    "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/24xxx/CVE-2026-24880.json",
    "references": [
      "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
    ],
    "title": "Apache Tomcat: Request smuggling via invalid chunk extension",
    "updated": "2026-04-10T18:33:49.308000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-444"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-04-09T20:16:24.060000+00:00",
    "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-24880.json",
    "references": [
      "http://www.openwall.com/lists/oss-security/2026/04/09/20",
      "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
    ],
    "title": null,
    "updated": "2026-10-26T21:10:00.170000+00:00",
    "vendors": [
      "apache",
      "apache$PRODUCT$tomcat"
    ],
    "weaknesses": [
      "CWE-444"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-04-09T19:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Apache Tomcat: Request smuggling via invalid chunk extension",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-444"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "5423237b-34e5-459c-9a45-9471db5f0907"
      },
      {
        "created": "2026-04-10T00:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "http://www.openwall.com/lists/oss-security/2026/04/09/20"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "18c003ad-95bb-4006-bedc-3bed8da2d96f"
      },
      {
        "created": "2026-04-10T09:00:00+00:00",
        "data": [
          {
            "details": [
              "apache",
              "apache$PRODUCT$tomcat"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "apache",
                "apache$PRODUCT$tomcat"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "ae6d1dc4-2637-4f84-bb2d-e6ef7cf135fe"
      },
      {
        "created": "2026-04-10T12:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://nvd.nist.gov/vuln/detail/CVE-2026-24880",
                "https://www.cve.org/CVERecord?id=CVE-2026-24880"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 4.3,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
                }
              },
              "removed": {},
              "updated": {
                "threat_severity": {
                  "new": "Low",
                  "old": null
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "5cb59da0-a4db-4d5d-8b40-6c983e91e037"
      },
      {
        "created": "2026-04-10T19:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {
                "cvssV3_1": {
                  "new": {
                    "score": 7.5,
                    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                  },
                  "old": {
                    "score": 4.3,
                    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
                  }
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "e736c43b-b08e-46c3-92d3-14ad22acbe5f"
      },
      {
        "created": "2026-04-14T20:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "c753036d-fba6-42fc-a4cd-4c4300b18741"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2026-04-09T19:12:10+00:00",
      "provider": "redhat"
    },
    "description": {
      "data": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 7.5,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        },
        "provider": "vulnrichment"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00709
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": "Low",
        "provider": "redhat"
      }
    },
    "references": {
      "data": [
        "http://www.openwall.com/lists/oss-security/2026/04/09/20",
        "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-24880",
        "https://www.cve.org/CVERecord?id=CVE-2026-24880"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    },
    "title": {
      "data": "Apache Tomcat: Request smuggling via invalid chunk extension",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-04-15T16:00:07.801031+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "apache",
        "apache$PRODUCT$tomcat"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-444"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    }
  },
  "redhat": {
    "cpes": [],
    "created": "2026-04-09T19:12:10+00:00",
    "description": "A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP requests are processed, potentially leading to the bypassing of security controls, cache poisoning, or other malicious activities.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 4.3,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
      },
      "threat_severity": "Low"
    },
    "redhat_repo_path": "2026/CVE-2026-24880.json",
    "references": [
      "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-24880",
      "https://www.cve.org/CVERecord?id=CVE-2026-24880"
    ],
    "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension",
    "updated": "2026-04-09T19:12:10+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-444"
    ]
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-04-09T19:12:10.730000+00:00",
    "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
      },
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Apache Tomcat: Request smuggling via invalid chunk extension",
    "updated": "2026-04-10T18:32:35.220000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/24xxx/CVE-2026-24880.json",
    "weaknesses": []
  }
}