CVE-2026-77756: Apache Tomcat HTTP Smuggling DOS Vulnerability

CVE-2026-77756 Overview

CVE-2026-77756 is an HTTP Request Smuggling vulnerability [CWE-444] in Apache Tomcat. The flaw stems from inconsistent processing of the Transfer-Encoding header for HTTP/1.0 requests. When Tomcat sits behind a reverse proxy, an attacker can leverage the parsing mismatch to cause another user's request to fail.

The issue affects Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.47 through 9.0.121. End-of-life versions 8.5.67 through 8.5.100 are also known to be affected. Fixed releases are 11.0.26, 10.1.60, and 9.0.122.

Critical Impact
A remote unauthenticated attacker can disrupt legitimate user requests when Tomcat is deployed behind a reverse proxy, producing a limited availability impact.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.25
Apache Tomcat 10.1.0-M1 through 10.1.59
Apache Tomcat 9.0.47 through 9.0.121 (and EOL 8.5.67 through 8.5.100)

Discovery Timeline

2026-09-23 - CVE-2026-77756 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77756

Vulnerability Analysis

HTTP Request Smuggling occurs when two HTTP intermediaries interpret request boundaries differently. In this case, Apache Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, even though HTTP/1.0 does not formally support chunked transfer encoding. A front-end reverse proxy may ignore or reject this header while Tomcat honors it, or vice versa.

This mismatch lets an attacker craft a request that the proxy treats as one message but Tomcat parses as two. The smuggled fragment interferes with the next queued request on the shared connection between the proxy and Tomcat. The practical outcome documented for this CVE is that one request from another user fails.

The vulnerability requires the target to be deployed behind a reverse proxy. It requires no authentication and no user interaction, but exploitation carries higher attack complexity than typical smuggling flaws.

Root Cause

The root cause is Tomcat's acceptance and processing of the Transfer-Encoding header on HTTP/1.0 requests. RFC compliance requires HTTP/1.0 messages to rely on Content-Length for framing. Honoring Transfer-Encoding on HTTP/1.0 diverges from front-end behavior and creates the desynchronization primitive.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP/1.0 request containing a Transfer-Encoding: chunked header through the reverse proxy to Tomcat. The proxy frames the request one way, Tomcat frames it another, and the residual bytes corrupt the next request sharing the upstream connection. The technique aligns with classic CL.TE and TE.CL smuggling patterns documented for HTTP request/response smuggling.

See the Apache Mailing List Discussion and OpenWall Security Bulletin for the full advisory details.

Detection Methods for CVE-2026-77756

Indicators of Compromise

HTTP/1.0 requests arriving at Tomcat that include a Transfer-Encoding header, which is non-standard for that protocol version.
Unexplained HTTP 400 or 502 responses correlating with requests from unrelated clients on the same proxy-to-Tomcat connection.
Reverse proxy access logs showing request/response pairing anomalies or truncated bodies from upstream Tomcat instances.

Detection Strategies

Inspect front-end proxy and Tomcat access logs for HTTP/1.0 requests carrying Transfer-Encoding: chunked and alert on the combination.
Deploy web application firewall rules that reject or normalize requests containing both Content-Length and Transfer-Encoding headers.
Correlate spikes in failed requests across distinct client sessions that traverse the same upstream connection pool.

Monitoring Recommendations

Enable verbose request-line logging on the reverse proxy to capture the exact HTTP version and framing headers.
Monitor Tomcat catalina.out and access logs for parser errors or connection resets tied to malformed request framing.
Track error-rate baselines per upstream connection so smuggling-induced failures surface against normal traffic patterns.

How to Mitigate CVE-2026-77756

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.26, 10.1.60, or 9.0.122 depending on the branch in use.
Retire any EOL Tomcat 8.5.x deployments, which will not receive fixes for this issue.
Configure the front-end reverse proxy to strip or reject Transfer-Encoding headers on HTTP/1.0 requests before forwarding upstream.

Patch Information

The Apache Tomcat project fixed the issue in versions 11.0.26, 10.1.60, and 9.0.122. The patched releases correct the handling of the Transfer-Encoding header on HTTP/1.0 requests so that Tomcat's framing aligns with reverse proxies. Administrators should validate the deployed version after upgrade using catalina.sh version.

Workarounds

Normalize inbound HTTP at the reverse proxy: reject requests where Transfer-Encoding is present alongside HTTP/1.0.
Disable HTTP/1.0 support at the edge proxy where business requirements permit.
Terminate keep-alive between the proxy and Tomcat, or reduce upstream connection reuse, to shrink the smuggling window.

bash

# Example NGINX snippet to strip Transfer-Encoding on HTTP/1.0 requests
location / {
    if ($server_protocol = "HTTP/1.0") {
        proxy_set_header Transfer-Encoding "";
    }
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_pass http://tomcat_backend;
}