AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2021-33037.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSMEDIUM / 5.3CVSS 3.1 · nvd@nist.gov
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSModifiedModified Oct 08, 2026

Disclosure summary

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Source-reported weakness categories

CWE-444

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2021-33037

Open original source · Updated Oct 08, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

VendorProduct / associationVersion / bounds
apachetomcat* {"versionStartExcluding":"10.0.0","versionEndIncluding":"10.0.6"}
apachetomee8.0.6
debiandebian_linux9.0
debiandebian_linux10.0
oracleagile_product_lifecycle_management9.3.6
oraclecommunications_cloud_native_core_policy1.14.0
oraclecommunications_cloud_native_core_service_communication_proxy1.14.0
oraclecommunications_diameter_signaling_router* {"versionStartIncluding":"8.0.0.0","versionEndIncluding":"8.5.0.2"}
oraclecommunications_instant_messaging_server10.0.1.5.0
oraclecommunications_policy_management12.5.0
oraclecommunications_pricing_design_center12.0.0.3.0
oraclecommunications_session_report_manager* {"versionStartIncluding":"8.0.0","versionEndIncluding":"8.2.4.0"}
oraclecommunications_session_route_manager* {"versionStartIncluding":"8.0.0","versionEndIncluding":"8.2.4"}
oraclegraph_server_and_client* {"versionEndExcluding":"21.4"}
oraclehealthcare_translational_research4.1.0
oraclehospitality_cruise_shipboard_property_management_system20.1.0
oracleinstantis_enterprisetrack17.1
oracleinstantis_enterprisetrack17.2
oracleinstantis_enterprisetrack17.3
oraclemanaged_file_transfer12.2.1.3.0
oraclemanaged_file_transfer12.2.1.4.0
oraclemysql_enterprise_monitor* {"versionEndIncluding":"8.0.25"}
oraclesd-wan_edge9.0
oraclesd-wan_edge9.1
oraclesecure_global_desktop5.6
oracleutilities_testing_accelerator6.0.0.1.1
oracleutilities_testing_accelerator6.0.0.2.2
oracleutilities_testing_accelerator6.0.0.3.1
mcafeeepolicy_orchestrator* {"versionEndExcluding":"5.10.0"}
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0
mcafeeepolicy_orchestrator5.10.0

Original records & references

PUBLISHED 2021-07-12T11:15:08-04:00
MODIFIED 2026-10-08T18:17:09-04:00
INGESTED 2026-10-10T20:50:20-04:00