CVE-2026-77756
Received Received - Intake

HTTP Request Smuggling in Apache Tomcat

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77756
EUVD
EUVD-2026-85226

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache tomcat From 11.0.0-M1 (inc) to 11.0.25 (inc)
apache tomcat From 10.1.0-M1 (inc) to 10.1.59 (inc)
apache tomcat From 9.0.47 (inc) to 9.0.121 (inc)
apache tomcat From 8.5.67 (inc) to 8.5.100 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an HTTP Request/Response Smuggling vulnerability in Apache Tomcat. It occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request inconsistently. This may allow an attacker to cause one user's request to fail by interfering with another user's request when Tomcat is behind a reverse proxy.

Detection Guidance

Detecting this vulnerability requires checking Apache Tomcat versions and analyzing HTTP request handling. First, verify your Tomcat version using commands like 'catalina.sh version' or 'docker inspect <container> | grep Tomcat'. Then, inspect reverse proxy configurations for improper transfer-encoding header handling. Use tools like Wireshark or tcpdump to capture and analyze HTTP traffic for malformed requests.

Impact Analysis

An attacker could exploit this to disrupt services, cause request failures for other users, or potentially bypass security controls. Systems relying on Tomcat behind a reverse proxy are most at risk.

Compliance Impact

The vulnerability could potentially expose sensitive data by allowing HTTP request smuggling, which may lead to unauthorized access or data leaks. This could violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately upgrade Apache Tomcat to a patched version: 11.0.26, 10.1.60, or 9.0.122. If upgrading is not possible, review and adjust reverse proxy settings to properly handle transfer-encoding headers. Disable HTTP/1.0 support if not required. Monitor network traffic for suspicious patterns indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart