CyberRota Analysis
AI-GeneratedApache Tomcat versions 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.47 through 9.0.121 are vulnerable to an HTTP Request/Response Smuggling issue that can lead to request failures for users when Tomcat is behind a reverse proxy. This vulnerability, while rated low in severity, should be prioritized by organizations using affected versions to prevent potential disruptions in service. Users are advised to upgrade to the patched versions 11.0.26, 10.1.60, or 9.0.122 to mitigate the risk.
Original NVD Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.