Inconsistent interpretation of HTTP requests in Apache Tomcat, arising from an invalid chunk extension in the request body, permits HTTP request smuggling. This flaw allows an attacker to craft requests that the server parses incorrectly, potentially causing the server to misinterpret request boundaries. The CVE description does not explicitly state what an attacker can achieve; however, it is inferred that such smuggling could lead to bypassing authentication checks, manipulation of forwarded headers, or injection of hidden traffic that might be leveraged for further attacks.

Apache Tomcat releases from version 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.115, 10.1.0-M1 through 10.1.52, and 11.0.0-M1 through 11.0.18 are affected. Unsupported older releases may also be vulnerable.

The vulnerability is exploitable over standard inbound HTTP traffic by sending crafted chunked requests that include an invalid chunk extension. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the nature of request smuggling indicates a significant risk. The lack of a defined CVSS score makes it difficult to quantify severity, but the potential impact on confidentiality, integrity, and availability suggests that patching should be prioritized.