Incorrect Transfer-Encoding handling with HTTP/1.0
No sign of exploitation. No public exploitation artifact known so far.
Apache Tomcat versions 8.5, 9.0, and 10.0 have a flaw where they don't properly handle the HTTP transfer-encoding header in certain cases, allowing an attacker to manipulate how requests are processed when Tomcat sits behind a reverse proxy. This can lead to request smuggling attacks where one request is interpreted differently by the proxy and Tomcat, bypassing security controls.
The vulnerability stems from improper Transfer-Encoding header parsing: Tomcat ignores transfer-encoding if a client requests HTTP/1.0 responses, incorrectly honors identity encoding, and fails to validate that chunked encoding is the final encoding in the chain. When deployed behind a reverse proxy, this discrepancy enables HTTP request smuggling (CWE-444), allowing attackers to inject requests that bypass WAF or authentication mechanisms.