Apache Tomcat incorrectly processes the Transfer‑Encoding header in HTTP/1.0 requests, which can lead to HTTP request smuggling. This flaw may let an attacker manipulate how Tomcat parses request boundaries, potentially causing a legitimate request from one user to be dropped or merged with another. The result is a loss of availability, as valid traffic can be disrupted.

Apache Tomcat versions 11.0.0‑M1 through 11.0.25, 10.1.0‑M1 through 10.1.59, 9.0.47 through 9.0.121, and older EOL releases 8.5.67 through 8.5.100 are affected. Any unsupported or older builds may also be impacted.

The attack vector is network‑based; an attacker must send a crafted HTTP/1.0 request with a Transfer‑Encoding header to a Tomcat instance that is behind a reverse proxy. The CVSS score of 3.7 indicates low severity, and the EPSS score is not available while the issue is not listed in CISA KEV, so no widespread exploitation has been observed. Nevertheless, this flaw can still be used to disrupt services, and operators should treat it as a potential denial‑of‑service risk.