CVE intelligence and bounded remediation

CVE-2021-33037 — Apache Tomcat security vulnerability

Medium CVSS 5.3

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Severity
Medium
CVSS
5.3 (3.1)
Published
2021-07-12
CISA KEV
Not currently listed
Ecosystem
software/application
Weaknesses
CWE-444

Affected products

  • apache / tomcat
  • apache / tomee / 8.0.6
  • debian / debian_linux / 9.0
  • debian / debian_linux / 10.0
  • oracle / agile_plm / 9.3.6
  • oracle / communications_cloud_native_core_policy / 1.14.0

Showing 6 representative product identities from 42 source matches. Confirm exact affected versions with the linked vendor and NVD evidence.

Matched remediation archetype

HTTP request smuggling and message-boundary ambiguity

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Inventory every proxy, CDN, gateway, load balancer, service mesh, and application server hop on affected request paths.
  • Compare documented parsing and normalization behavior for message length, transfer coding, duplicate headers, and protocol translation.
  • Identify connection reuse and which downstream services trust headers added by intermediaries.

Remediate safely

  • Update affected intermediaries and origin servers and align them on a single standards-compliant request framing policy.
  • Reject ambiguous length, transfer-coding, duplicate, malformed, and unsupported framing before forwarding.
  • Normalize or remove hop-by-hop and identity headers at one controlled boundary and add multi-hop regression tests.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.