Skip to content

Commit 2bf881b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-563x-q5rq-57qp GHSA-69cc-cv78-qc8g GHSA-69r9-qgr7-g2wj GHSA-8mc5-53m5-3qj2 GHSA-95jq-rwvf-vjx4 GHSA-563x-q5rq-57qp GHSA-69cc-cv78-qc8g GHSA-69r9-qgr7-g2wj GHSA-8mc5-53m5-3qj2 GHSA-95jq-rwvf-vjx4
1 parent c1eb2ff commit 2bf881b

10 files changed

Lines changed: 1108 additions & 187 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-563x-q5rq-57qp",
4+
"modified": "2026-04-10T22:07:01Z",
5+
"published": "2026-04-09T21:31:29Z",
6+
"aliases": [
7+
"CVE-2026-24880"
8+
],
9+
"summary": "Apache Tomcat has an HTTP Request/Response Smuggling vulnerability",
10+
"details": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.tomcat:tomcat-catalina"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.0.0"
29+
},
30+
{
31+
"fixed": "9.0.116"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.tomcat:tomcat-catalina"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.1.0-M1"
48+
},
49+
{
50+
"fixed": "10.1.52"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.apache.tomcat:tomcat-catalina"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.0.0-M1"
67+
},
68+
{
69+
"fixed": "11.0.20"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.apache.tomcat:tomcat"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "7.0.0"
86+
},
87+
{
88+
"fixed": "9.0.116"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Maven",
97+
"name": "org.apache.tomcat:tomcat"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "10.1.0-M1"
105+
},
106+
{
107+
"fixed": "10.1.52"
108+
}
109+
]
110+
}
111+
]
112+
},
113+
{
114+
"package": {
115+
"ecosystem": "Maven",
116+
"name": "org.apache.tomcat:tomcat"
117+
},
118+
"ranges": [
119+
{
120+
"type": "ECOSYSTEM",
121+
"events": [
122+
{
123+
"introduced": "11.0.0-M1"
124+
},
125+
{
126+
"fixed": "11.0.20"
127+
}
128+
]
129+
}
130+
]
131+
},
132+
{
133+
"package": {
134+
"ecosystem": "Maven",
135+
"name": "org.apache.tomcat.embed:tomcat-embed-core"
136+
},
137+
"ranges": [
138+
{
139+
"type": "ECOSYSTEM",
140+
"events": [
141+
{
142+
"introduced": "7.0.0"
143+
},
144+
{
145+
"fixed": "9.0.116"
146+
}
147+
]
148+
}
149+
]
150+
},
151+
{
152+
"package": {
153+
"ecosystem": "Maven",
154+
"name": "org.apache.tomcat.embed:tomcat-embed-core"
155+
},
156+
"ranges": [
157+
{
158+
"type": "ECOSYSTEM",
159+
"events": [
160+
{
161+
"introduced": "10.1.0-M1"
162+
},
163+
{
164+
"fixed": "10.1.52"
165+
}
166+
]
167+
}
168+
]
169+
},
170+
{
171+
"package": {
172+
"ecosystem": "Maven",
173+
"name": "org.apache.tomcat.embed:tomcat-embed-core"
174+
},
175+
"ranges": [
176+
{
177+
"type": "ECOSYSTEM",
178+
"events": [
179+
{
180+
"introduced": "11.0.0-M1"
181+
},
182+
{
183+
"fixed": "11.0.20"
184+
}
185+
]
186+
}
187+
]
188+
}
189+
],
190+
"references": [
191+
{
192+
"type": "ADVISORY",
193+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880"
194+
},
195+
{
196+
"type": "PACKAGE",
197+
"url": "https://github.com/apache/tomcat"
198+
},
199+
{
200+
"type": "WEB",
201+
"url": "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
202+
},
203+
{
204+
"type": "WEB",
205+
"url": "http://www.openwall.com/lists/oss-security/2026/04/09/20"
206+
}
207+
],
208+
"database_specific": {
209+
"cwe_ids": [
210+
"CWE-444"
211+
],
212+
"severity": "HIGH",
213+
"github_reviewed": true,
214+
"github_reviewed_at": "2026-04-10T22:07:01Z",
215+
"nvd_published_at": "2026-04-09T20:16:24Z"
216+
}
217+
}

0 commit comments

Comments
 (0)