CVE-2021-33037: HTTP Request Smuggling in Apache Tomcat
Summary
CVE-2021-33037: HTTP Request Smuggling in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 8.5.0, < 8.5.68
>= 9.0.0-M1, < 9.0.48
>= 10.0.0-M1, < 10.0.7
Fixed in 8.5.68, 9.0.48 or 10.0.7, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-33037 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66 of Apache Tomcat are vulnerable to an HTTP request smuggling attack. This vulnerability arises from the incorrect parsing of the HTTP transfer-encoding request header in certain scenarios, which can lead to request smuggling when used with a reverse proxy.
Vulnerability Detail
The vulnerability in Apache Tomcat allows an attacker to perform HTTP request smuggling attacks. The specific issues are as follows:
- Tomcat incorrectly ignores the transfer encoding header if the client declares that it will only accept an HTTP/1.0 response.
- Tomcat honors the identity encoding, which can be abused by an attacker to manipulate the request/response boundaries.
- Tomcat does not ensure that the chunked encoding, if present, is the final encoding.
These issues can be exploited by an attacker to bypass security controls, manipulate requests, and potentially access sensitive information or perform unauthorized actions.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.688.5.68 -
>= 9.0.0-M1, < 9.0.489.0.48 -
>= 10.0.0-M1, < 10.0.710.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by configuring the reverse proxy to reject requests with multiple Content-Length headers or requests with both Transfer-Encoding and Content-Length headers. This can help mitigate the risk of request smuggling attacks.
Conclusion
The HTTP request smuggling vulnerability in Apache Tomcat can be exploited by attackers to bypass security controls and potentially access sensitive information or perform unauthorized actions. It is crucial to upgrade to the latest patched version of Apache Tomcat to mitigate this vulnerability. If immediate upgrade is not possible, implementing the suggested workaround can help reduce the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
HTTP request smuggling is a technique that allows an attacker to manipulate the way a web server processes HTTP requests, potentially bypassing security controls and gaining unauthorized access to sensitive information.
This vulnerability can be exploited by sending specially crafted HTTP requests that manipulate the request/response boundaries, allowing an attacker to bypass security controls and potentially access sensitive information or perform unauthorized actions.
No, only versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66 of Apache Tomcat are affected by this vulnerability.
To mitigate the risk of this vulnerability, it is recommended to upgrade to the latest patched version of Apache Tomcat. If immediate upgrade is not feasible, configure the reverse proxy to reject requests with multiple Content-Length headers or requests with both Transfer-Encoding and Content-Length headers.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
