CVE-2026-77756

Apache Tomcat improperly honors the Transfer-Encoding header on HTTP/1.0 requests, even though chunked transfer coding is only defined for HTTP/1.1. When Tomcat sits behind a reverse proxy, the front end and Tomcat can disagree about how the request body is framed, allowing an attacker to smuggle a request and desynchronize the connection. The practical impact is limited to availability: an attacker can cause one request from another user to fail, with no confidentiality or integrity impact (CVSS 3.7, low, high attack complexity). Affected deployments span Tomcat 11.0.0-M1–11.0.25, 10.1.0-M1–10.1.59, 9.0.47–9.0.121, and the EOL 8.5.67–8.5.100 line, which includes Tomcat embedded in products such as Spring Boot applications. No public proof-of-concept exists and the issue is not in the CISA KEV catalog, so exploitation is not known to be occurring.

What to do: Upgrade to Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch; 8.5.x users must move to 9.0.122+ since 8.5 is end-of-life. If immediate patching is not possible, configure the front-end reverse proxy (nginx, Apache httpd, load balancer) to reject or strip Transfer-Encoding headers on HTTP/1.0 requests, which is invalid per spec. Embedded-Tomcat consumers such as Spring Boot should move to a framework release that bundles a fixed Tomcat version.