{"id":"CVE-2026-88041","kind":"vulnerability","aliases":["CVE-2026-88041"],"related":[],"title":"Apache Tomcat: trailer headers from one request can leak into another","description":"Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","summary":"Apache Tomcat did not fully clear HTTP trailer data between requests, so trailer information from a previous request can appear in a later request. An attacker may be able to read data left over from another user's request.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","runtime","self-hosted","tomcat"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges: 11.0.0-M23 to 11.0.26, 10.1.27 to 10.1.60, and 9.0.92 to 9.0.122.","fix":"- Upgrade Apache Tomcat 11.x to `11.0.27` or later.\n- Upgrade Apache Tomcat 10.1.x to `10.1.61` or later.\n- Upgrade Apache Tomcat 9.0.x to `9.0.123` or later.","status":"open","published_at":"2026-10-20T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T05:04:45+00:00","updated_at":"2026-10-25T05:04:45+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:04:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Tomcat 11.x to `11.0.27` or later.\n- Upgrade Apache Tomcat 10.1.x to `10.1.61` or later.\n- Upgrade Apache Tomcat 9.0.x to `9.0.123` or later.","reach":"unknown","title":"Apache Tomcat: trailer headers from one request can leak into another","impact":"low","summary":"Apache Tomcat did not fully clear HTTP trailer data between requests, so trailer information from a previous request can appear in a later request. An attacker may be able to read data left over from another user's request.","category":"runtime","nicknames":[],"who_cares":["java","tomcat","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Data from another user's request may be readable","analyst_note":"Check the Apache Tomcat security advisory for trigger conditions and whether trailers must be enabled for exposure.","how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges: 11.0.0-M23 to 11.0.26, 10.1.27 to 10.1.60, and 9.0.92 to 9.0.122.","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running an affected Apache Tomcat release that serves requests with HTTP trailers, typically behind shared connections or proxies handling multiple users. Systems on Tomcat versions outside the listed ranges are not affected. The sources do not say how easily a request can be made to pick up another request's trailers.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000632,"input_tokens":3368,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88041':14A,17A '10.1.27':94C '10.1.60':96C '10.1.61':109C '11.0.0':89C '11.0.26':92C '11.0.27':108C '9.0.122':100C '9.0.123':111C '9.0.92':98C 'abl':52B 'affect':85C 'allow':69C 'anoth':11A,59B 'apach':1A,24B,67C,86C 'appear':43B 'attack':49B 'cleanup':64C 'clear':29B 'cve':12A,15A 'data':32B,55B 'fix':113C 'fulli':28B 'header':4A 'host':22B 'http':30B 'incomplet':63C 'inform':37B,72C 'issu':84C,115C 'java':18B 'later':46B 'leak':9A,78C 'left':56B 'm23':90C 'may':50B 'one':6A 'previous':40B,75C 'read':54B 'recommend':103C 'request':7A,34B,41B,47B,62B,76C,82C 'runtim':19B 'self':21B 'self-host':20B 'subsequ':81C 'tomcat':2A,23B,25B,68C,87C 'trailer':3A,31B,36B,71C 'upgrad':105C 'user':60B,101C 'version':107C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Teams running an affected Apache Tomcat release that serves requests with HTTP trailers, typically behind shared connections or proxies handling multiple users. Systems on Tomcat versions outside the listed ranges are not affected. The sources do not say how easily a request can be made to pick up another request's trailers.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88041","severity":null,"published_at":"2026-10-20T14:17:04+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}