{"id":"CVE-2021-33037","published":"2021-07-12T14:55:15Z","modified":"2026-10-08T21:13:49Z","title":"Incorrect Transfer-Encoding handling with HTTP/1.0","vendor":"Apache Software Foundation","product":"Apache Tomcat","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["Apache Tomcat 10 10.0.0-M1 to 10.0.6","Apache Tomcat 9 9.0.0.M1 to 9.0.46","Apache Tomcat 8 8.5.0 to 8.5.66"]}],"description":{"text":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Tomcat (versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66) mishandles the HTTP Transfer-Encoding request header in certain cases, ignoring it when the client declares it only accepts HTTP/1.0 responses, honouring the identity encoding, and not requiring chunked to be the final encoding. An attacker able to send crafted requests through a reverse proxy in front of Tomcat could smuggle HTTP requests past the proxy, with no authentication or user interaction indicated as required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:46Z"},"cvss":null,"epss":{"score":0.74667,"percentile":0.99501,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 2025","url":"https://otx.alienvault.com/pulse/6807e1c45dd52410facbed8f","created":"2025-04-22"},{"name":"Oracle Critical Patch Update Advisory - April 2022","url":"https://otx.alienvault.com/pulse/626040216e00cd388b1b9180","created":"2022-04-20"},{"name":"Red Hat Customer Portal - Access to 24x7 support and knowledge","url":"https://otx.alienvault.com/pulse/625d58dbc24dc678720b223e","created":"2022-04-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-4952","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0007/","tags":["x_refsource_CONFIRM"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10366","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/202208-34","tags":["vendor-advisory","x_refsource_GENTOO"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.7",">=9.0.0-M1, <9.0.48",">=8.5.0, <8.5.68"],"patched":["10.0.7","9.0.48","8.5.68"],"from":["GHSA-4vww-mc66-62m6"],"provenance":"source"}],"advisories":[{"id":"GHSA-4vww-mc66-62m6","url":"https://github.com/advisories/GHSA-4vww-mc66-62m6","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.7"],"patched":["10.0.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4vww-mc66-62m6","url":"https://github.com/advisories/GHSA-4vww-mc66-62m6","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=9.0.0-M1, <9.0.48"],"patched":["9.0.48"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4vww-mc66-62m6","url":"https://github.com/advisories/GHSA-4vww-mc66-62m6","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=8.5.0, <8.5.68"],"patched":["8.5.68"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-1563","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1563","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-07-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-33037","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":21.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9950"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-5647","parents":[{"from":"CVE-2017-5651","to":"CVE-2021-33037","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/Http11Processor.java"],"commits":["https://github.com/apache/tomcat/commit/494429ca210641b6b7affe89a2b0a6c0ff70109b","https://github.com/apache/tomcat/commit/9233d9d6a018be4415d4d7d6cb4fe01176adf1a8","https://github.com/apache/tomcat/commit/05f9e8b00f5d9251fcd3c95dcfd6cf84177f46c8","https://github.com/apache/tomcat/commit/19d11556d0db99df291df33605f137976d152475"],"basis":"shared function","functions":["prepareRequest"]}]}],"children":[{"from":"CVE-2021-33037","to":"CVE-2025-66614","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/Http11Processor.java"],"commits":["https://github.com/apache/tomcat/commit/05f9e8b00f5d9251fcd3c95dcfd6cf84177f46c8","https://github.com/apache/tomcat/commit/19d11556d0db99df291df33605f137976d152475","https://github.com/apache/tomcat/commit/258a591b61f8cf5c22109e21e5a2a38b63454fd2","https://github.com/apache/tomcat/commit/152c14885d45f5e0a8b59bd9f93c289cfe20ce30"],"basis":"shared function","functions":["prepareRequest"]}]}],"packageHistory":[{"cve":"CVE-2021-41079","published":"2021-09-16","fixed":"10.0.4","kev":false},{"cve":"CVE-2021-30639","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-30640","published":"2021-07-12","fixed":"10.0.5","kev":false,"link":{"from":"CVE-2021-30640","to":"CVE-2021-33037","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.45","toFixed":"9.0.48","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.65","toFixed":"8.5.68","daysApart":0}]}},{"cve":"CVE-2021-33037","published":"2021-07-12","fixed":"10.0.7","kev":false},{"cve":"CVE-2022-23181","published":"2022-01-27","fixed":"10.0.16","kev":false},{"cve":"CVE-2021-43980","published":"2022-09-28","fixed":"10.1.0-M14","kev":false},{"cve":"CVE-2022-29885","published":"2022-05-12","fixed":"10.1.0-M15","kev":false},{"cve":"CVE-2021-42340","published":"2021-10-14","fixed":"10.1.0-M6","kev":false,"link":{"from":"CVE-2021-33037","to":"CVE-2021-42340","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.48","toFixed":"9.0.54","daysApart":94},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.68","toFixed":"8.5.72","daysApart":94}]}}],"package":"Maven:org.apache.tomcat:tomcat"}}