Apache Tomcat HTTP Request Smuggling Vulnerability (CVE-2021-33037) | Qualys

Summary: Apache Tomcat versions 10.0.0-M1 through 10.0.6, 9.0.0.M1 through 9.0.46, and 8.5.0 through 8.5.66 incorrectly parse the HTTP transfer-encoding request header in some circumstances, creating the possibility of HTTP Request Smuggling when Tomcat sits behind a reverse proxy. Qualys Web Application Scanning detects the flaw with QID 150367 by sending a GET /QUALYSTESTRANDOM.1tmhl HTTP/1.0 request and reading the Tomcat version from the response banner, and the fix is upgrading to 10.0.7, 9.0.48, 8.5.68 or later.
What's compelling: Request smuggling lets an attacker hide a second request inside the body of the first, so a single crafted request can slip past the reverse proxy that is supposed to be inspecting traffic - and the vulnerable version ranges span the 8.5, 9.0 and 10.0 lines that many estates still run.

Read the original at Qualys Blog ↗

Topics: Supply Chain & AppSec
Mentions: CVE-2021-33037
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026