Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.75, the 99th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:13 UTC First seen by agentprime
- 31 Oct 2026, 15:13 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-4vww-mc66-62m6
- OSV: GHSA-4vww-mc66-62m6
- nvd.nist.gov/vuln/detail/CVE-2021-33037
- github.com/apache/tomcat/commit/05f9e8b00f5d9251fcd3c95dcfd6cf84177f46c8
- github.com/apache/tomcat/commit/19d11556d0db99df291df33605f137976d152475
- github.com/apache/tomcat/commit/3202703e6d635e39b74262e81f0cb4bcbe2170dc
- github.com/apache/tomcat/commit/45d70a86a901cbd534f8f570bed2aec9f7f7b88e
- github.com/apache/tomcat/commit/506134f957a4be2c5b4a9334f7b3435fc954dbc1
- github.com/apache/tomcat/commit/8874fa02e9b36baa9ca6b226c0882c0190ca5a02
- github.com/apache/tomcat/commit/a2c3dc4c96168743ac0bab613709a5bbdaec41d0
- github.com/apache/tomcat/commit/da0e7cb093cf68b052d9175e469dbd0464441b0b
- github.com/apache/tomcat/commit/eee0d024c1b3171560c92eaba79dd6eb8eb11bcd
- security.gentoo.org/glsa/202208-34
- security.netapp.com/advisory/ntap-20210827-0007