PT-2026-31696

CVE-2026-24880

·

Published

2026-03-23

·

Updated

2026-09-18

Description by

CVSS 2.0
7.8
High
MetricsAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109
Description An inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') exists in Apache Tomcat due to an invalid chunk extension. This can potentially allow an attacker to smuggle requests, leading to unexpected behavior or security breaches.
Recommendations Upgrade to version 11.0.20 Upgrade to version 10.1.52 Upgrade to version 9.0.116
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')
Related identifiers
CVE-2026-24880
BDU:2026-06932
GHSA-563X-Q5RQ-57QP
ALSA-2026:25341
ALSA-2026:26323
ALSA-2026:36790
ALSA-2026:68677
BIT-TOMCAT-2026-24880
CLEANSTART-2026-PK48524
CLSA-2026-1785497476
CLSA-2026-1786121727
MGASA-2026-0095
OESA-2026-1970
OPENSUSE-SU-2026:10547-1
OPENSUSE-SU-2026:10548-1
OPENSUSE-SU-2026:10549-1
OPENSUSE-SU-2026:20595-1
OPENSUSE-SU-2026:20611-1
OPENSUSE-SU-2026:20612-1
RHSA-2026:20405
SUSE-SU-2026:1558-1
SUSE-SU-2026:1572-1
SUSE-SU-2026:1603-1
SUSE-SU-2026:1604-1
SUSE-SU-2026:21366-1
SUSE-SU-2026:21378-1
SUSE-SU-2026:21379-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com