CVE-2021-33037 EPSS 74.7%

Incorrect Transfer-Encoding handling with HTTP/1.0

Apache Software Foundation · Apache Tomcat

Summary

Apache Tomcat (versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66) mishandles the HTTP Transfer-Encoding request header in certain cases, ignoring it when the client declares it only accepts HTTP/1.0 responses, honouring the identity encoding, and not requiring chunked to be the final encoding. An attacker able to send crafted requests through a reverse proxy in front of Tomcat could smuggle HTTP requests past the proxy, with no authentication or user interaction indicated as required.

Official description · CVE.org

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Breakdown

21.3 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 12 Jul 2021. No public exploit code or confirmed exploitation is recorded.

See the family tree

5 related vulnerabilities in the same code over 5 years. The latest fix listed for tomcat is 10.1.0-M15.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2017-5647A bug in the handling of the pipelined requests in Apache Tomcat…17 Apr 2017
relatedMedium
Why these are linked:
- Same code patched: Http11Processor.java (machine-matched)commit 864aa11 commit a4efd3c commit 494429c commit 9233d9d
CVE-2017-5651In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the…17 Apr 2017
same family
CVE-2018-8037If an async request was completed by the application at the same…2 Aug 2018
same family
This CVECVE-2021-33037Incorrect Transfer-Encoding handling with HTTP/1.012 Jul 2021
same family
CVE-2021-43980Tomcat: Information disclosure28 Sep 2022

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

10.0.4CVE-2021-4107916 Sep 2021
10.0.5CVE-2021-3063912 Jul 2021
10.0.5CVE-2021-3064012 Jul 2021
10.0.7CVE-2021-3303712 Jul 2021
10.0.16CVE-2022-2318127 Jan 2022
10.1.0-M6CVE-2021-4234014 Oct 2021
10.1.0-M14CVE-2021-4398028 Sep 2022
10.1.0-M15CVE-2022-2988512 May 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-4vww-mc66-62m6

Upgrade to 10.0.22 or later

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-13934, CVE-2020-13935, +2).

Set the version to 10.0.22 or later in your pom.xml or build.gradle.

First fixed in 10.0.7 for CVE-2021-33037.

Affected versions, by release line

If you run	Upgrade to
10.0.0-M1 up to 10.0.7	10.0.22first fix for this CVE: 10.0.7
9.0.0-M1 up to 9.0.48	9.0.109first fix for this CVE: 9.0.48
8.5.0 up to 8.5.68 Still affected on this line by CVE-2025-55752 (no fix published).	8.5.82first fix for this CVE: 8.5.68

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 3 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 202522 Apr 2025
Oracle Critical Patch Update Advisory - April 202220 Apr 2022
Red Hat Customer Portal - Access to 24x7 support and knowledge18 Apr 2022

References

16 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2021-1563

No public exploit code found.

, 30 Oct 2026

74.7%Top 0.5%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.5%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9950 19.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses3 pulses 1.4/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total21.3

Record

Published: 12 Jul 2021
Modified: 8 Oct 2026
: CWE-444 Inconsistent Interpretation of HTTP Requests
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 3 community threat pulses (AlienVault OTX)

References

x_refsource_MISC 5

mailing-list 7

vendor-advisory 2

x_refsource_CONFIRM 2

techniques