Tomcat Trailer Info Leak 911 (CVE-2026-88041)
CVE-2026-88041 Published on October 20, 2026
Apache Tomcat: HTTP/2 trailer header cross-contamination
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.
This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Vulnerability Analysis
CVE-2026-88041 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an Insufficient Cleanup Vulnerability?
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.
CVE-2026-88041 has been classified to as an Insufficient Cleanup vulnerability or weakness.
Products Associated with CVE-2026-88041
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M23, <= 11.0.26 is affected.
- Version 10.1.27, <= 10.1.60 is affected.
- Version 9.0.92, <= 9.0.122 is affected.