Read the docs
TI-2021-12641 Aliases CVE-2021-33037GHSA-4vww-mc66-62m6

Incorrect Transfer-Encoding handling with HTTP/1.0

Priority HIGH 69CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.74667 99th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.0.7, 9.0.48, 8.5.68Red Hat: 4 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 10 10.0.0-M1 to 10.0.6; Apache Tomcat 9 9.0.0.M1 to 9.0.46; Apache Tomcat 8 8.5.0 to 8.5.66—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.0.0-M1 to before 10.0.710.0.7Patch availableGHSA-4vww-mc66-62m6
—org.apache.tomcat:tomcat (Maven)9.0.0-M1 to before 9.0.489.0.48Patch availableGHSA-4vww-mc66-62m6
—org.apache.tomcat:tomcat (Maven)8.5.0 to before 8.5.688.5.68Patch availableGHSA-4vww-mc66-62m6
  • Apache Tomcat VendorApache Affected Apache Tomcat 10 10.0.0-M1 to 10.0.6; Apache Tomcat 9 9.0.0.M1 to 9.0.46; Apache Tomcat 8 8.5.0 to 8.5.66 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.7 Fixed in 10.0.7 Patch available GHSA-4vww-mc66-62m6
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.48 Fixed in 9.0.48 Patch available GHSA-4vww-mc66-62m6
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.68 Fixed in 8.5.68 Patch available GHSA-4vww-mc66-62m6

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.0 – 8.5.66; after 9.0.0, up to 9.0.46; after 10.0.0, up to 10.0.6VulnerableApache
cpe:2.3:a:apache:tomee:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.5.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*10.0.1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*12.5.0VulnerableOracle
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.0 – 8.5.66; after 9.0.0, up to 9.0.46; after 10.0.0, up to 10.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomee:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.5.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* Versions 10.0.1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.0.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.0.0 – 8.2.4VulnerableOracle
cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:*before 21.4VulnerableOracle
cpe:2.3:a:oracle:healthcare_translational_research:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*20.1.0VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.25VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*5.6VulnerableOracle
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*6.0.0.1.1VulnerableOracle
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*6.0.0.2.2VulnerableOracle
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*6.0.0.3.1VulnerableOracle
cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*before 5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*5.10.0 update_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*5.10.0 update_10VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*5.10.0 update_2VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*5.10.0 update_3VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*5.10.0 update_4VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*5.10.0 update_5VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*5.10.0 update_6VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*5.10.0 update_7VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*5.10.0 update_8VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*5.10.0 update_9VulnerableMcAfee
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:* Versions before 21.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_translational_research:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:* Versions 20.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* Versions 6.0.0.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* Versions 6.0.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions before 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* Versions 5.10.0 update_10 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* Versions 5.10.0 update_4 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* Versions 5.10.0 update_5 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* Versions 5.10.0 update_6 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* Versions 5.10.0 update_7 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* Versions 5.10.0 update_8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* Versions 5.10.0 update_9 Vulnerable ·McAfee

Remediation

  • Fix · GHSA-4vww-mc66-62m6 org.apache.tomcat:tomcat (Maven) Fixed in 10.0.7 Advisory →
  • Fix · GHSA-4vww-mc66-62m6 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.48 Advisory →
  • Fix · GHSA-4vww-mc66-62m6 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.68 Advisory →

Red Hat 4 advisories

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2022:1179 Released 2022-04-12 · Red Hat rating Important
    Red Hat support for Spring Boot 2.5.10 update
    • Red Hat Support for Spring Boot 2.5.10
  • RHSA-2021:4861 Released 2021-11-30 · Red Hat rating Important
    Red Hat JBoss Web Server 5.6.0 Security release
    • Red Hat JBoss Web Server 5.6 for RHEL 7 Server jws5-tomcat-9.0.50-3.redhat_00004.1.el7jws, jws5-tomcat-admin-webapps-9.0.50-3.redhat_00004.1.el7jws, jws5-tomcat-docs-webapp-9.0.50-3.redhat_00004.1.el7jws +12
    • Red Hat JBoss Web Server 5.6 for RHEL 8 jws5-tomcat-9.0.50-3.redhat_00004.1.el8jws, jws5-tomcat-admin-webapps-9.0.50-3.redhat_00004.1.el8jws, jws5-tomcat-docs-webapp-9.0.50-3.redhat_00004.1.el8jws +10
Show 1 more Red Hat advisories
  • RHSA-2021:4863 Released 2021-11-30 · Red Hat rating Important
    Red Hat JBoss Web Server 5.6.0 Security release
    • Red Hat JBoss Web Server 5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — DSA-4952

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss Web Server 5Fixed RHSA-2021:4863
Red Hat JBoss Web Server 5.6 for RHEL 7 ServerFixed RHSA-2021:4861
Red Hat JBoss Web Server 5.6 for RHEL 8Fixed RHSA-2021:4861
Red Hat Support for Spring Boot 2.5.10Fixed RHSA-2022:1179
Not affected: 10 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Web Server 3
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33037
  2. 2026-10-03 Alias added: GHSA-4vww-mc66-62m6
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: MEDIUM → HIGH

References

Patch 4

Advisory 7

Other 27

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences