This vulnerability in Apache Tomcat arises from inconsistent parsing of HTTP requests due to invalid chunk extensions, classified under CWE-444 (Inconsistent Interpretation of HTTP Requests). It affects a broad range of Apache Tomcat versions starting from early milestone releases through recent stable releases up to 11.0.18, 10.1.52, and 9.0.115. The issue can be exploited to perform HTTP Request/Response Smuggling attacks, which may allow attackers to interfere with the processing of HTTP requests and responses. The Apache Software Foundation has addressed this vulnerability in versions 11.0.20, 10.1.52, and 9.0.116.

The vulnerability enables attackers to exploit inconsistent HTTP request parsing to perform HTTP Request/Response Smuggling attacks. This can lead to manipulation of HTTP traffic integrity, potentially allowing unauthorized request injection or bypassing security controls. The CVSS score of 7.5 indicates a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality is not impacted, but integrity is compromised, and availability is unaffected.

Users should upgrade Apache Tomcat to versions 11.0.20, 10.1.52, or 9.0.116, which contain fixes for this vulnerability. No other mitigation or temporary workaround is specified. Patch status is confirmed by the vendor advisory recommending these version upgrades.