{"id":"CVE-2021-33037","details":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","aliases":["BIT-tomcat-2021-33037","GHSA-4vww-mc66-62m6"],"modified":"2026-07-08T06:00:38.785480528Z","published":"2021-07-12T15:15:08.400Z","related":["SUSE-SU-2021:3602-1","SUSE-SU-2021:3669-1","SUSE-SU-2021:3670-1","SUSE-SU-2021:3672-1","SUSE-SU-2026:1058-1","openSUSE-SU-2021:1490-1","openSUSE-SU-2021:3672-1","openSUSE-SU-2024:11618-1","openSUSE-SU-2024:13441-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"5.10.0"}],"source":"CPE_RANGE","vendor_product":"mcafee:epolicy_orchestrator"},{"vendor_product":"oracle:communications_diameter_signaling_router","cpes":["cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0.0"},{"last_affected":"8.5.0.2"}],"source":"CPE_RANGE"},{"vendor_product":"oracle:communications_session_report_manager","cpes":["cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.2.4.0"}],"source":"CPE_RANGE"},{"cpes":["cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.2.4"}],"source":"CPE_RANGE","vendor_product":"oracle:communications_session_route_manager"},{"vendor_product":"oracle:graph_server_and_client","cpes":["cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"21.4"}],"source":"CPE_RANGE"},{"extracted_events":[{"last_affected":"8.0.25"}],"source":"CPE_RANGE","vendor_product":"oracle:mysql_enterprise_monitor","cpes":["cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"]},{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING"},{"vendor_product":"mcafee:epolicy_orchestrator","cpes":["cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*","cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.10.0-NA"},{"last_affected":"5.10.0-NA"},{"introduced":"5.10.0-update_1"},{"last_affected":"5.10.0-update_1"},{"introduced":"5.10.0-update_10"},{"last_affected":"5.10.0-update_10"},{"introduced":"5.10.0-update_2"},{"last_affected":"5.10.0-update_2"},{"introduced":"5.10.0-update_3"},{"last_affected":"5.10.0-update_3"},{"introduced":"5.10.0-update_4"},{"last_affected":"5.10.0-update_4"},{"introduced":"5.10.0-update_5"},{"last_affected":"5.10.0-update_5"},{"introduced":"5.10.0-update_6"},{"last_affected":"5.10.0-update_6"},{"introduced":"5.10.0-update_7"},{"last_affected":"5.10.0-update_7"},{"introduced":"5.10.0-update_8"},{"last_affected":"5.10.0-update_8"},{"introduced":"5.10.0-update_9"},{"last_affected":"5.10.0-update_9"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:agile_plm","cpes":["cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.3.6"},{"last_affected":"9.3.6"}]},{"cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.14.0"},{"last_affected":"1.14.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_policy"},{"cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.14.0"},{"last_affected":"1.14.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_service_communication_proxy"},{"extracted_events":[{"introduced":"10.0.1.5.0"},{"last_affected":"10.0.1.5.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_instant_messaging_server","cpes":["cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*"]},{"vendor_product":"oracle:communications_policy_management","cpes":["cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.5.0"},{"last_affected":"12.5.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.0.0.3.0"},{"last_affected":"12.0.0.3.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_pricing_design_center"},{"cpes":["cpe:2.3:a:oracle:healthcare_translational_research:4.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"}],"source":"CPE_STRING","vendor_product":"oracle:healthcare_translational_research"},{"cpes":["cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"20.1.0"},{"last_affected":"20.1.0"}],"source":"CPE_STRING","vendor_product":"oracle:hospitality_cruise_shipboard_property_management_system"},{"source":"CPE_STRING","vendor_product":"oracle:instantis_enterprisetrack","cpes":["cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.1"},{"last_affected":"17.1"},{"introduced":"17.2"},{"last_affected":"17.2"},{"introduced":"17.3"},{"last_affected":"17.3"}]},{"cpes":["cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}],"source":"CPE_STRING","vendor_product":"oracle:managed_file_transfer"},{"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"9.1"},{"last_affected":"9.1"}],"source":"CPE_STRING","vendor_product":"oracle:sd-wan_edge","cpes":["cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.6"},{"last_affected":"5.6"}],"source":"CPE_STRING","vendor_product":"oracle:secure_global_desktop"},{"cpes":["cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.0.1.1"},{"last_affected":"6.0.0.1.1"},{"introduced":"6.0.0.2.2"},{"last_affected":"6.0.0.2.2"},{"introduced":"6.0.0.3.1"},{"last_affected":"6.0.0.3.1"}],"source":"CPE_STRING","vendor_product":"oracle:utilities_testing_accelerator"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E"},{"type":"ADVISORY","url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10366"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202208-34"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20210827-0007/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4952"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomcat","events":[{"introduced":"e37b977db6f47e4380ad67114a49e8568951c953"},{"last_affected":"12afa2cd11ffa9522cd98acc228ecb1bad6b8006"},{"introduced":"0"},{"last_affected":"37ae42a2996911b9ba6b88e7b0828f855b9d38f6"},{"last_affected":"f725f57f195de035a5cbc6602a1f7a3ad43ee5b5"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.5.0"},{"last_affected":"8.5.66"},{"introduced":"0"},{"last_affected":"9.0.46"},{"last_affected":"10.0.6"}]}}],"versions":["8.5.66","9.0.46","10.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33037.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomee","events":[{"introduced":"20441ebda4f7afaa606f48b00fb5eb28053b69f1"},{"last_affected":"20441ebda4f7afaa606f48b00fb5eb28053b69f1"}],"database_specific":{"source":"CPE_STRING","cpe":"cpe:2.3:a:apache:tomee:8.0.6:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.0.6"},{"last_affected":"8.0.6"}]}}],"versions":["8.0.6","tomee-8.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33037.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}