CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination
Published Oct 20, 2026
·Updated
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.
This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Affected Software
1 affected component
Apache Tomcat>=11.0.0-M23<=11.0.26, >=10.1.27<=10.1.60, >=9.0.92<=9.0.122
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Oct 20, 2026
CVE Published
via MITRE·01:43 PM
Data Sourced
via MITRE·01:43 PM
DescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionWeakness