CVE-2021-33037: Incorrect Transfer-Encoding handling with HTTP/1.0
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Other sources
Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially-crafted HTTP(S) transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-33037?
The severity of CVE-2021-33037 is medium with a CVSS score of 4.3.
How does CVE-2021-33037 affect Apache Tomcat?
CVE-2021-33037 affects Apache Tomcat versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66.
What is the remedy for CVE-2021-33037?
The remedy for CVE-2021-33037 is to upgrade Apache Tomcat to version 10.0.7, 9.0.48, or 8.5.68.
Where can I find more information about CVE-2021-33037?
You can find more information about CVE-2021-33037 at the following references: [CVE-2021-33037 at CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-33037) and [CVE-2021-33037 at NIST](https://nvd.nist.gov/vuln/detail/CVE-2021-33037).
What is the CWE for CVE-2021-33037?
The CWE for CVE-2021-33037 is CWE-444.