BIT-tomcat-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Which Tomcat versions need to be upgraded?
Affected versions are 11.0.0 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122. Upgrade to 11.0.27, 10.1.61, or 9.0.123, respectively.
What is the impact of this issue?
Trailer information from a previous HTTP/2 request can leak into a subsequent request because request cleanup is incomplete. This can cause cross-request contamination of trailer data.