CVE-2026-88041
—UnscoredPublished 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- CWE-459
Impact
Attackers can intercept sensitive trailer headers leaked from other users' prior requests. They only need network access to send HTTP requests to the exposed Tomcat instance.
Root cause
Tomcat fails to completely clean up request state, allowing trailer header data from one request to persist into a subsequent request.
Affected systems
Apache Tomcat 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122
Fix & remediation
Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 depending on your release branch. No interim workarounds are documented, so upgrading is required.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.