3.7

CVE-2026-77756

Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerApache Software Foundation
≫
Produkt Apache Tomcat
Default Statusunaffected
Version <= 11.0.25
Version 11.0.0-M1
Status affected
Version <= 10.1.59
Version 10.1.0-M1
Status affected
Version <= 9.0.121
Version 9.0.47
Status affected
Version <= 8.5.100
Version 8.5.67
Status affected
Version <= 7.0.109
Version 0
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.154
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z
http://www.openwall.com/lists/oss-security/2026/09/23/22