CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.26 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.60 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.122
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments where Apache Tomcat is located behind a reverse proxy are exposed to the described request-smuggling condition. The stated impact is that an attacker may cause a request from another user to fail.
What does an attacker need to send to exploit the issue?
The issue is triggered by processing a Transfer-Encoding header on an HTTP/1.0 request. The provided information does not identify any authentication or other access prerequisite.
Which Tomcat versions should be upgraded?
Upgrade affected supported branches to Tomcat 11.0.26, 10.1.60, or 9.0.122. Known affected ranges are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.47 through 9.0.121; 8.5.67 through 8.5.100 is also known affected but was already end of life.
Are unsupported Tomcat releases in scope?
Tomcat 8.5.67 through 8.5.100 is known to be affected despite being end of life when the CVE was created. Other unsupported versions may also be affected.