Tomcat versions 7 through 11 intentionally accept HTTP requests that contain an improperly formed chunk extension and process the boundaries of the request differently than expected. This ambiguity enables an attacker to smuggle a second request into the same connection, potentially allowing the attacker to bypass access controls, extract sensitive data, or redirect traffic. The flaw is classified as CWE‑444, indicating an inconsistency in HTTP request/response handling.

Affected products are Apache Tomcat from the Apache Software Foundation. Vulnerable releases cover Tomcat 11.0.0‑M1 through 11.0.18, 10.1.0‑M1 through 10.1.52, 9.0.0‑M1 through 9.0.115, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109; older or unsupported releases may also be impacted.

The CVSS base score of 7.5 marks the bug as high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation observed in the wild. The vulnerability is not cataloged in CISA's KEV database. Based on the description, it is inferred that attacks likely proceed over HTTP from a remote client, do not require prior authentication, and rely on the transmission of a crafted request that includes a malformed chunk extension to a Tomcat instance exposed to the internet.