CVE-2021-33037: Apache Tomcat

Medium severity, CVSS 5.3. EPSS: 74.7% chance of exploitation in the next 30 days.

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Affected products

  • Apache Tomcat: from 8.5.0, up to and including 8.5.66; after 9.0.0, up to and including 9.0.46; after 10.0.0, up to and including 10.0.6
  • Apache Tomee: version 8.0.6 only
  • Debian Debian Linux: version 9.0 only; version 10.0 only
  • McAfee Epolicy Orchestrator: before 5.10.0 (fixed in 5.10.0); version 5.10.0 only
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Communications Cloud Native Core Service Communication Proxy: version 1.14.0 only
  • Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.5.0.2
  • Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
  • Oracle Communications Policy Management: version 12.5.0 only
  • Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
  • Oracle Communications Session Report Manager: from 8.0.0, up to and including 8.2.4.0
  • Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.4
  • Oracle Graph Server And Client: before 21.4 (fixed in 21.4)
  • Oracle Healthcare Translational Research: version 4.1.0 only
  • Oracle Hospitality Cruise Shipboard Property Management System: version 20.1.0 only
  • Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
  • Oracle Managed File Transfer: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle MySQL Enterprise Monitor: up to and including 8.0.25
  • Oracle SD-WAN Edge: version 9.0 only; version 9.1 only
  • Oracle Secure Global Desktop: version 5.6 only
  • Oracle Utilities Testing Accelerator: version 6.0.0.1.1 only; version 6.0.0.2.2 only; version 6.0.0.3.1 only

Published 2021-07-12. Last modified 2026-10-08.