CVE-2026-77756

Name	CVE-2026-77756
Description	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1148824

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tomcat10 (PTS)	bookworm, bookworm (security)	10.1.55-1~deb12u1	vulnerable
	trixie (security), trixie	10.1.55-1~deb13u1	vulnerable
	forky, sid	10.1.60-1	fixed
tomcat11 (PTS)	trixie (security), trixie	11.0.22-1~deb13u1	vulnerable
	forky, sid	11.0.24-1	vulnerable
tomcat9 (PTS)	bookworm	9.0.70-2	fixed
	trixie	9.0.95-1	fixed
	forky, sid	9.0.122-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
tomcat10	source	(unstable)	10.1.60-1
tomcat11	source	(unstable)	(unfixed)	1148824
tomcat9	source	(unstable)	9.0.70-2

Notes

Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
https://github.com/apache/tomcat/commit/1ad63de866a6e7007304ebe5165f72e65ece32b6 (11.0.26)
https://github.com/apache/tomcat/commit/bf44bee23d97fbb1a64cbbbb213ff2b6506d26c4 (10.1.60)
https://github.com/apache/tomcat/commit/e590588ab7649c93d49b0eb7b3152700a977880d (9.0.122)