CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Low-severity Tomcat flaw honors Transfer-Encoding on HTTP/1.0, enabling request smuggling.
Mark Thomas disclosed CVE-2026-77756, a low-severity HTTP request-smuggling flaw in Apache Tomcat. Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, causing inconsistent interpretation of HTTP requests. Affected versions include 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.47 through 9.0.121, 8.5.67 through 8.5.100, and releases through 7.0.109. The advisory does not report active exploitation.
- Low-severity HTTP request-smuggling flaw in Apache Tomcat.
- Transfer-Encoding is processed for HTTP/1.0 requests.
- Affects Tomcat 11.0, 10.1, 9.0, 8.5, and 7.0 lines.
- No in-the-wild exploitation is described.
- CVEs
- CVE-2026-77756
- Vendors
- Apache
- Products
- Apache Tomcat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77756 | HTTP Request Smuggling via Transfer-Encoding on HTTP/1.0 in Apache Tomcat | 3.7 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: low Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.