Vulnerability Report

CVE-2026-24880

Title: HTTP Request/Response Smuggling via invalid chunk extension

Other

Proof Of Concept

PoC Available for CVE-2026-24880

CWE Category CWE-444

Published Date Apr 09, 2026

Modified Date Apr 14, 2026

Exploit Status Available

Score 7.5 CVSS v

Exploit Probability (EPSS)

0.68%

Vulnerability Summary

CVE-2026-24880: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Impacted Vendors

apache 1

Reference Links

https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns