PT-2026-31696 · Apache+2 · Apache Tomcat+2

Xclow3N · Published 2026-03-23 · Updated 2026-05-22 · CVE-2026-24880

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109

Description An inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') exists in Apache Tomcat due to an invalid chunk extension. This can potentially allow an attacker to smuggle requests, leading to unexpected behavior or security breaches.

Recommendations Upgrade to version 11.0.20 Upgrade to version 10.1.52 Upgrade to version 9.0.116

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2026-06932

BIT-TOMCAT-2026-24880

CVE-2026-24880

GHSA-563X-Q5RQ-57QP

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

Affected Products

Apache Tomcat

Confluence

Red Os

References · 98

• https://osv.dev/vulnerability/SUSE-SU-2026:1558-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34483 · Security Note
• https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1604-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20611-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20595-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24880 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29146 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-24880 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1970 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10548-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25854 · Security Note
• https://bdu.fstec.ru/vul/2026-06932 · Security Note