{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "9.0.116"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0",
        "7.0.100",
        "7.0.103",
        "7.0.104",
        "7.0.105",
        "7.0.106",
        "7.0.107",
        "7.0.108",
        "7.0.109",
        "7.0.11",
        "7.0.12",
        "7.0.14",
        "7.0.16",
        "7.0.19",
        "7.0.2",
        "7.0.20",
        "7.0.21",
        "7.0.22",
        "7.0.23",
        "7.0.25",
        "7.0.26",
        "7.0.27",
        "7.0.28",
        "7.0.29",
        "7.0.30",
        "7.0.32",
        "7.0.33",
        "7.0.34",
        "7.0.35",
        "7.0.37",
        "7.0.39",
        "7.0.4",
        "7.0.40",
        "7.0.41",
        "7.0.42",
        "7.0.47",
        "7.0.5",
        "7.0.50",
        "7.0.52",
        "7.0.53",
        "7.0.54",
        "7.0.55",
        "7.0.56",
        "7.0.57",
        "7.0.59",
        "7.0.6",
        "7.0.61",
        "7.0.62",
        "7.0.63",
        "7.0.64",
        "7.0.65",
        "7.0.67",
        "7.0.68",
        "7.0.69",
        "7.0.70",
        "7.0.72",
        "7.0.73",
        "7.0.75",
        "7.0.76",
        "7.0.77",
        "7.0.78",
        "7.0.79",
        "7.0.8",
        "7.0.81",
        "7.0.82",
        "7.0.84",
        "7.0.85",
        "7.0.86",
        "7.0.88",
        "7.0.90",
        "7.0.91",
        "7.0.92",
        "7.0.93",
        "7.0.94",
        "7.0.96",
        "7.0.99",
        "8.0.0-RC1",
        "8.0.0-RC10",
        "8.0.0-RC3",
        "8.0.0-RC5",
        "8.0.1",
        "8.0.11",
        "8.0.12",
        "8.0.14",
        "8.0.15",
        "8.0.17",
        "8.0.18",
        "8.0.20",
        "8.0.21",
        "8.0.22",
        "8.0.23",
        "8.0.24",
        "8.0.26",
        "8.0.27",
        "8.0.28",
        "8.0.29",
        "8.0.3",
        "8.0.30",
        "8.0.32",
        "8.0.33",
        "8.0.35",
        "8.0.36",
        "8.0.37",
        "8.0.38",
        "8.0.39",
        "8.0.41",
        "8.0.42",
        "8.0.43",
        "8.0.44",
        "8.0.45",
        "8.0.46",
        "8.0.47",
        "8.0.48",
        "8.0.49",
        "8.0.5",
        "8.0.50",
        "8.0.51",
        "8.0.52",
        "8.0.53",
        "8.0.8",
        "8.0.9",
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99",
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.113",
        "9.0.115",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.52"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.50",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "<= 11.0.18",
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.18",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "9.0.116"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0",
        "7.0.100",
        "7.0.103",
        "7.0.104",
        "7.0.105",
        "7.0.106",
        "7.0.107",
        "7.0.108",
        "7.0.109",
        "7.0.11",
        "7.0.12",
        "7.0.14",
        "7.0.16",
        "7.0.19",
        "7.0.2",
        "7.0.20",
        "7.0.21",
        "7.0.22",
        "7.0.23",
        "7.0.25",
        "7.0.26",
        "7.0.27",
        "7.0.28",
        "7.0.29",
        "7.0.30",
        "7.0.32",
        "7.0.33",
        "7.0.34",
        "7.0.35",
        "7.0.37",
        "7.0.39",
        "7.0.4",
        "7.0.40",
        "7.0.41",
        "7.0.42",
        "7.0.47",
        "7.0.5",
        "7.0.50",
        "7.0.52",
        "7.0.53",
        "7.0.54",
        "7.0.55",
        "7.0.56",
        "7.0.57",
        "7.0.59",
        "7.0.6",
        "7.0.61",
        "7.0.62",
        "7.0.63",
        "7.0.64",
        "7.0.65",
        "7.0.67",
        "7.0.68",
        "7.0.69",
        "7.0.70",
        "7.0.72",
        "7.0.73",
        "7.0.75",
        "7.0.76",
        "7.0.77",
        "7.0.78",
        "7.0.79",
        "7.0.8",
        "7.0.81",
        "7.0.82",
        "7.0.84",
        "7.0.85",
        "7.0.86",
        "7.0.88",
        "7.0.90",
        "7.0.91",
        "7.0.92",
        "7.0.93",
        "7.0.94",
        "7.0.96",
        "7.0.99",
        "8.0.0-RC1",
        "8.0.0-RC10",
        "8.0.0-RC3",
        "8.0.0-RC5",
        "8.0.1",
        "8.0.11",
        "8.0.12",
        "8.0.14",
        "8.0.15",
        "8.0.17",
        "8.0.18",
        "8.0.20",
        "8.0.21",
        "8.0.22",
        "8.0.23",
        "8.0.24",
        "8.0.26",
        "8.0.27",
        "8.0.28",
        "8.0.29",
        "8.0.3",
        "8.0.30",
        "8.0.32",
        "8.0.33",
        "8.0.35",
        "8.0.36",
        "8.0.37",
        "8.0.38",
        "8.0.39",
        "8.0.41",
        "8.0.42",
        "8.0.43",
        "8.0.44",
        "8.0.45",
        "8.0.46",
        "8.0.47",
        "8.0.48",
        "8.0.49",
        "8.0.5",
        "8.0.50",
        "8.0.51",
        "8.0.52",
        "8.0.53",
        "8.0.8",
        "8.0.9",
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99",
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.113",
        "9.0.115",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.52"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.50",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "<= 11.0.18",
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-563x-q5rq-57qp/GHSA-563x-q5rq-57qp.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.18",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T22:07:01Z",
    "nvd_published_at": "2026-04-09T20:16:24Z",
    "severity": "HIGH"
  },
  "details": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
  "id": "GHSA-563x-q5rq-57qp",
  "modified": "2026-09-10T09:40:56.206928669Z",
  "published": "2026-04-09T21:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/1b586d6aa8ae65726da5fa8799427b5d4718478a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/1e71441a15972f56e661b0b549fb9e5d838b83bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/6d478dbe18b7c4bb671c30fedf130309b0dab77c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/f07df938d00f7419b40fa65aa912966d0efac522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116"
    },
    {
      "type": "WEB",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2026-24880"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/04/09/20"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Tomcat has an HTTP Request/Response Smuggling vulnerability"
}