CVE-2026-77756
published 2026-09-23CVE-2026-77756: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding…
PriorityP417low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.26%
15.8th percentile
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.59 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.25 | — |
| apache_software_foundation | apache_tomcat | 8.5.67 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.47 – 9.0.121 | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Tomcat up to 11.0.25/10.1.59/9.0.121/8.5.100 Transfer-Encoding expected behavior violation (WID-SEC-2026-3527)
vuldb·2026-09-24·CVSS 3.7
CVE-2026-77756 [LOW] Apache Tomcat up to 11.0.25/10.1.59/9.0.121/8.5.100 Transfer-Encoding expected behavior violation (WID-SEC-2026-3527)
A vulnerability identified as critical has been detected in Apache Tomcat up to 11.0.25/10.1.59/9.0.121/8.5.100. The impacted element is an unknown function of the component Transfer-Encoding. Performing a manipulation results in expected behavior violation.
This vulnerability is identified as CVE-2026-77756. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an a
ghsa_unreviewed·2026-09-23
CVE-2026-77756 [LOW] CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an a
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Red Hat
tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service
vendor_redhat·2026-09-23·CVSS 3.7
CVE-2026-77756 [LOW] CWE-444 tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service
tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
A flaw was found i
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77756 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022 tomcat: various flaw
bugzilla·2026-09-29·CVSS 9.8
CVE-2026-73581 [CRITICAL] CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77756 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022 tomcat: various flaw
CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77756 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022 tomcat: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.
The following versions were EOS at the time the CVE was created but are kn
Bugzilla
CVE-2026-77756 tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service
bugzilla·2026-09-23·CVSS 3.7
CVE-2026-77756 [LOW] CVE-2026-77756 tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service
CVE-2026-77756 tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue
2026-09-23
Published