Fixed in Apache Tomcat 8.5.96

Important: Request smuggling CVE-2023-46589

Tomcat did not correctly parse HTTP trailer headers. A specially crafted trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit aa92971e.

This issue was reported to the Tomcat Security Team on 20 October 2023. The issue was made public on 28 November 2023.

Affects: 8.5.0 to 8.5.95