CVE-2021-33037: Apache Tomcat HTTP transfer-encoding parsing flaw enables request smuggling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS 3.1 base score is 5.3 (MEDIUM) with only low integrity impact, but EPSS is very high at 0.75353 and the flaw is not in KEV.

What it is

Apache Tomcat versions 10.0.0-M1 through 10.0.6, 9.0.0.M1 through 9.0.46, and 8.5.0 through 8.5.66 parse the HTTP transfer-encoding header incorrectly in some cases. Tomcat ignores the header when the client only accepts an HTTP/1.0 response, honours the identity encoding, and does not require chunked to be the final encoding. When Tomcat sits behind a reverse proxy, these mismatches can allow request smuggling.

Impact

An attacker can desynchronise the front-end proxy and Tomcat's view of the request stream, letting them smuggle a request that is processed under another user's context or bypass front-end access controls. The CVSS vector rates only low integrity impact, so direct confidentiality or availability loss is not established by the record.

Attack surface

Reachable over the network with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Exploitation requires Tomcat to be deployed behind a reverse proxy that parses transfer-encoding differently, which is the precondition stated in the description.

Exploitation

Not listed in CISA KEV and no ransomware groups are documented as using it. EPSS is high at 0.75353 (99.489th percentile), and references are vendor advisories and patch notices with no public exploit tag.

What to do

• Upgrade Tomcat to a release after 10.0.6, 9.0.46 or 8.5.66; apply the vendor fix first.
• Apply the Oracle CPU patches (July 2021, October 2021, January 2022, April 2022) for affected Oracle products embedding Tomcat.
• Apply Debian DSA-4952 and the Gentoo GLSA 202208-34 updates for packaged Tomcat.
• Ensure the reverse proxy and Tomcat agree on transfer-encoding handling, and reject requests where chunked is not the final encoding.
• Remove or restrict the identity transfer-encoding path at the proxy layer until patched.

Detection

• Compare proxy and Tomcat access logs for requests where the two disagree on method, path or body length.
• Alert on requests carrying transfer-encoding: identity or multiple transfer-encoding values, especially with HTTP/1.0 responses.
• Flag requests where chunked is not the last transfer-encoding token.
• Look for repeated or queued requests on a single connection that produce unexpected second responses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.