CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Low-severity Tomcat flaw honors Transfer-Encoding on HTTP/1.0, enabling request smuggling.
Mark Thomas disclosed CVE-2026-77756, a low-severity HTTP request-smuggling flaw in Apache Tomcat. Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, causing inconsistent interpretation of HTTP requests. Affected versions include 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.47 through 9.0.121, 8.5.67 through 8.5.100, and releases through 7.0.109. The advisory does not report active exploitation.
- Low-severity HTTP request-smuggling flaw in Apache Tomcat.
- Transfer-Encoding is processed for HTTP/1.0 requests.
- Affects Tomcat 11.0, 10.1, 9.0, 8.5, and 7.0 lines.
- No in-the-wild exploitation is described.
Vulnerabilities mentionedAll →
- CVE-2026-777563.7—HTTP Request Smuggling via Transfer-Encoding on HTTP/1.0 in Apache Tomcatpublished · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-77756 | HTTP Request Smuggling via Transfer-Encoding on HTTP/1.0 in Apache Tomcat Apache Tomcat improperly honors the Transfer-Encoding header on HTTP/1.0 requests, even though chunked transfer coding is only defined for HTTP/1.1. When Tomcat sits behind a reverse proxy, the front end and Tomcat can disagree about how the request body is framed, allowing an attacker to smuggle a request and desynchronize the connection. The practical impact is limited to availability: an attacker can cause one request from another user to fail, with no confidentiality or integrity impact (CVSS 3.7, low, high attack complexity). Affected deployments span Tomcat 11.0.0-M1–11.0.25, 10.1.0-M1–10.1.59, 9.0.47–9.0.121, and the EOL 8.5.67–8.5.100 line, which includes Tomcat embedded in products such as Spring Boot applications. No public proof-of-concept exists and the issue is not in the CISA KEV catalog, so exploitation is not known to be occurring. |
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.25 - Apache Tomcat 10.1.0-M1 through 10.1.59 - Apache Tomcat 9.0.47 through 9.0.121 - Apache Tomcat 8.5.67 through 8.5.100 - Apache Tomcat through 7.0.109 unaffected Description: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0...
This source does not provide full text. Read it at seclists.org.