CVE-2021-33037
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Apache Tomcat versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66 incorrectly parsed the HTTP transfer-encoding request header in some circumstances, leading to request smuggling when used with a reverse proxy. Specifically, Tomcat ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response, honored the identity encoding, and did not ensure that chunked encoding was the final encoding.
Risk Assessment
The risk is the possibility of an attacker intercepting and manipulating HTTP requests, which could lead to bypassing security controls, data theft, or attacks on other users.
Recommendation
Update Apache Tomcat to a patched version. Also, configure reverse proxies securely to avoid issues with transfer-encoding headers.
Original NVD description (English source)
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.