CVE-2021-33037

High

High exploit probability or critical severity with a known exploit.

CVSS base

5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — probability of exploitation (30 days)

75.4%

99.5th percentile

CISA KEV

Not listed

Weakness / dates

CWE-444

Published 2021-07-12 · modified 2026-08-25

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	N	None
Integrity	L	Low
Availability	N	None

Timeline

2021-07-12 — Published (NVD)
2026-08-25 — Last modified (NVD)

Description

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Affected

apache debian mcafee oracle

References

Official: NVD · CVE.org