PT-2026-31696 · Apache+2 · Apache Tomcat+2

Xclow3N · CVE-2026-24880 · Published 2026-03-23 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109

Description An inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') exists in Apache Tomcat due to an invalid chunk extension. This can potentially allow an attacker to smuggle requests, leading to unexpected behavior or security breaches.

Recommendations Upgrade to version 11.0.20 Upgrade to version 10.1.52 Upgrade to version 9.0.116

Exploit

Fix

DoS

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2026-06932

BIT-TOMCAT-2026-24880

CVE-2026-24880

GHSA-563X-Q5RQ-57QP

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

RHSA-2026:20405

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

SUSE-SU-2026:21366-1

SUSE-SU-2026:21378-1

SUSE-SU-2026:21379-1

Affected Products

Apache Tomcat

Confluence

Red Os

References · 101

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24880.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34500 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1603-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10548-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06932 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24880 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24880 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20611-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1558-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1970 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10547-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32990 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29146 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24880 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/732373 · Security Note