CVE-2021-33037

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-444

Affected software

VendorProductVersions
Apache Software FoundationApache TomcatApache Tomcat 10 10.0.0-M1 to 10.0.6; Apache Tomcat 9 9.0.0.M1 to 9.0.46; Apache Tomcat 8 8.5.0 to 8.5.66

References

Timeline

Published
Jul 12, 2021
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-330387.5An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's arcCVE-2021-33049.8Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.CVE-2021-330406.1managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.CVE-2021-330416.1vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').exCVE-2021-330449.8The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identityCVE-2021-330459.8The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identityCVE-2021-330469.8Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specifCVE-2021-33057.8Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.CVE-2021-330547.5SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with nCVE-2021-330559.8Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.CVE-2021-330567.5Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.CVE-2021-330577.5The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo
CVE-2021-33037: Medium severity, CVSS 5.3 | Vulnix