AI analysis
Apache Tomcat improperly honors the Transfer-Encoding header on HTTP/1.0 requests, even though chunked transfer coding is only defined for HTTP/1.1. When Tomcat sits behind a reverse proxy, the front end and Tomcat can disagree about how the request body is framed, allowing an attacker to smuggle a request and desynchronize the connection. The practical impact is limited to availability: an attacker can cause one request from another user to fail, with no confidentiality or integrity impact (CVSS 3.7, low, high attack complexity). Affected deployments span Tomcat 11.0.0-M1–11.0.25, 10.1.0-M1–10.1.59, 9.0.47–9.0.121, and the EOL 8.5.67–8.5.100 line, which includes Tomcat embedded in products such as Spring Boot applications. No public proof-of-concept exists and the issue is not in the CISA KEV catalog, so exploitation is not known to be occurring.
What to do: Upgrade to Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch; 8.5.x users must move to 9.0.122+ since 8.5 is end-of-life. If immediate patching is not possible, configure the front-end reverse proxy (nginx, Apache httpd, load balancer) to reject or strip Transfer-Encoding headers on HTTP/1.0 requests, which is invalid per spec. Embedded-Tomcat consumers such as Spring Boot should move to a framework release that bundles a fixed Tomcat version.
Affected
| Apache Tomcat | 11.0.0-M1 through 11.0.25 |
| Apache Tomcat | 10.1.0-M1 through 10.1.59 |
| Apache Tomcat | 9.0.47 through 9.0.121 |
| Apache Tomcat | 8.5.67 through 8.5.100 (EOL at CVE creation; other unsupported versions may also be affected) |
Estimated exposure
massmillions of Tomcat installations worldwide, with the genuinely at-risk subset being deployments running Tomcat behind a reverse proxy — Tomcat is the dominant open-source Java servlet container (including as the default embedded server in Spring Boot), and public scan engines routinely show hundreds of thousands of internet-exposed Tomcat instances; only fronted…
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.