Is CVE-2021-33037 being actively exploited?

CVE-2021-33037 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2021-33037?

CVE-2021-33037 has a CVSS 3.1 base score of 5.3 (MEDIUM).

CVE-2021-33037

MEDIUM · CVSS 5.3EPSS 74.7%EU EUVD

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Key facts

CVSS score: 5.3 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-444
EPSS score: 74.7% (99th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2021-1563)
Published: July 12, 2021
NVD last modified: October 8, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2021-1563 in the EU Vulnerability Database. Last updated in EUVD on October 8, 2026.

View on the EU Vulnerability Database

Affected products

apache / tomcat
apache / tomee
debian / debian linux
debian / debian linux
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
oracle / agile product lifecycle management
oracle / communications cloud native core policy
oracle / communications cloud native core service communication proxy
oracle / communications diameter signaling router
oracle / communications instant messaging server
oracle / communications policy management
oracle / communications pricing design center
oracle / communications session report manager
oracle / communications session route manager
oracle / graph server and client
oracle / healthcare translational research
oracle / hospitality cruise shipboard property management system
oracle / instantis enterprisetrack
oracle / instantis enterprisetrack
oracle / instantis enterprisetrack
oracle / managed file transfer
oracle / managed file transfer
oracle / mysql enterprise monitor
oracle / sd-wan edge
oracle / sd-wan edge
oracle / secure global desktop
oracle / utilities testing accelerator
oracle / utilities testing accelerator
oracle / utilities testing accelerator

Certified products that may be affected

2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

McAfee Application Control v5.0, Change Control v5.0, and Integrity Monitor v5.0 with McAfee Agent v4.5 and ePolicy Orchestrator v4.5 - McAfee, Inc. - Common Criteria 383-4-153 - archived
McAfee VirusScan Enterprise v8.5i and McAfee ePolicy Orchestrator v3.6 - McAfee, Inc. - Common Criteria CCEVS-VR-0047-2007 - archived

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10366(Third Party Advisory)
https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E(Mailing List, Vendor Advisory)
https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html(Mailing List, Third Party Advisory)
https://security.gentoo.org/glsa/202208-34(Third Party Advisory)
https://security.netapp.com/advisory/ntap-20210827-0007/(Third Party Advisory)
https://www.debian.org/security/2021/dsa-4952(Third Party Advisory)
https://www.oracle.com//security-alerts/cpujul2021.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
https://www.oracle.com/security-alerts/cpuoct2021.html(Patch, Third Party Advisory)

Last updated October 10, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain