Medium
Security advisory
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-33037
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:51 UTC · Revision 1
Source evidence
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
osv:CVE-2021-33037
Complete source record
{
"id": "0ebce4ad8b82dc89b91a10bb0d6554a23489270ebf3d8472bdf095f9e58109cc",
"url": "https://osv.dev/vulnerability/CVE-2021-33037",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-33037",
"summary": "Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.",
"evidence": "osv:CVE-2021-33037",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-33037",
"aliases": [
"BIT-tomcat-2021-33037",
"CVE-2021-33037",
"GHSA-4vww-mc66-62m6"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/tomcat",
"type": "GIT",
"events": [
{
"introduced": "e37b977db6f47e4380ad67114a49e8568951c953"
},
{
"last_affected": "12afa2cd11ffa9522cd98acc228ecb1bad6b8006"
},
{
"introduced": "0"
},
{
"last_affected": "37ae42a2996911b9ba6b88e7b0828f855b9d38f6"
},
{
"last_affected": "f725f57f195de035a5cbc6602a1f7a3ad43ee5b5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.66"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "9.0.46"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "10.0.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"8.5.66",
"9.0.46",
"10.0.6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33037.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/apache/tomee",
"type": "GIT",
"events": [
{
"introduced": "20441ebda4f7afaa606f48b00fb5eb28053b69f1"
},
{
"last_affected": "20441ebda4f7afaa606f48b00fb5eb28053b69f1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomee:8.0.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.6"
},
{
"last_affected": "8.0.6"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"8.0.6",
"tomee-8.0.6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33037.json"
}
}
],
"modified": "2026-10-24T10:30:45.546265483Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E",
"https://kc.mcafee.com/corporate/index?page=content&id=SB10366",
"https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html",
"https://security.gentoo.org/glsa/202208-34",
"https://security.netapp.com/advisory/ntap-20210827-0007/",
"https://www.debian.org/security/2021/dsa-4952",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*"
],
"vendor_product": "mcafee:epolicy_orchestrator",
"extracted_events": [
{
"range": [
{
"fixed": "5.10.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_diameter_signaling_router",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0.0"
},
{
"last_affected": "8.5.0.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_report_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.2.4.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_route_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.2.4"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:graph_server_and_client",
"extracted_events": [
{
"range": [
{
"fixed": "21.4"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:mysql_enterprise_monitor",
"extracted_events": [
{
"range": [
{
"last_affected": "8.0.25"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
"cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*"
],
"vendor_product": "mcafee:epolicy_orchestrator",
"extracted_events": [
{
"range": [
{
"introduced": "5.10.0-NA"
},
{
"last_affected": "5.10.0-NA"
},
{
"introduced": "5.10.0-update_1"
},
{
"last_affected": "5.10.0-update_1"
},
{
"introduced": "5.10.0-update_10"
},
{
"last_affected": "5.10.0-update_10"
},
{
"introduced": "5.10.0-update_2"
},
{
"last_affected": "5.10.0-update_2"
},
{
"introduced": "5.10.0-update_3"
},
{
"last_affected": "5.10.0-update_3"
},
{
"introduced": "5.10.0-update_4"
},
{
"last_affected": "5.10.0-update_4"
},
{
"introduced": "5.10.0-update_5"
},
{
"last_affected": "5.10.0-update_5"
},
{
"introduced": "5.10.0-update_6"
},
{
"last_affected": "5.10.0-update_6"
},
{
"introduced": "5.10.0-update_7"
},
{
"last_affected": "5.10.0-update_7"
},
{
"introduced": "5.10.0-update_8"
},
{
"last_affected": "5.10.0-update_8"
},
{
"introduced": "5.10.0-update_9"
},
{
"last_affected": "5.10.0-update_9"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:agile_product_lifecycle_management",
"extracted_events": [
{
"range": [
{
"introduced": "9.3.6"
},
{
"last_affected": "9.3.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_policy",
"extracted_events": [
{
"range": [
{
"introduced": "1.14.0"
},
{
"last_affected": "1.14.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_service_communication_proxy",
"extracted_events": [
{
"range": [
{
"introduced": "1.14.0"
},
{
"last_affected": "1.14.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_instant_messaging_server",
"extracted_events": [
{
"range": [
{
"introduced": "10.0.1.5.0"
},
{
"last_affected": "10.0.1.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_policy_management",
"extracted_events": [
{
"range": [
{
"introduced": "12.5.0"
},
{
"last_affected": "12.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_pricing_design_center",
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0.3.0"
},
{
"last_affected": "12.0.0.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:healthcare_translational_research:4.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:healthcare_translational_research",
"extracted_events": [
{
"range": [
{
"introduced": "4.1.0"
},
{
"last_affected": "4.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:hospitality_cruise_shipboard_property_management_system",
"extracted_events": [
{
"range": [
{
"introduced": "20.1.0"
},
{
"last_affected": "20.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:instantis_enterprisetrack",
"extracted_events": [
{
"range": [
{
"introduced": "17.1"
},
{
"last_affected": "17.1"
},
{
"introduced": "17.2"
},
{
"last_affected": "17.2"
},
{
"introduced": "17.3"
},
{
"last_affected": "17.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:managed_file_transfer",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:sd-wan_edge",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "9.1"
},
{
"last_affected": "9.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:secure_global_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "5.6"
},
{
"last_affected": "5.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:utilities_testing_accelerator",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.0.1.1"
},
{
"last_affected": "6.0.0.1.1"
},
{
"introduced": "6.0.0.2.2"
},
{
"last_affected": "6.0.0.2.2"
},
{
"introduced": "6.0.0.3.1"
},
{
"last_affected": "6.0.0.3.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-33037",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436140,
"published_at": "2021-07-12T15:15:08.4+00:00"
}