Incomplete Cleanup Vulnerability in Apache Tomcat by Apache Software Foundation
CVE-2026-88041

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
20 October 2026

What is CVE-2026-88041?

An incomplete cleanup vulnerability identified in Apache Tomcat allows sensitive trailer information from previous requests to inadvertently leak into subsequent requests. This can potentially expose sensitive data, making it crucial for users of impacted versions to upgrade to patched releases. Specifically, users should transition to Apache Tomcat versions 11.0.27, 10.1.61, or 9.0.123 to eliminate the risk associated with this issue. Ensuring your software is updated is vital for maintaining security and data integrity.

Affected Version(s)

Apache Tomcat 11.0.0-M23 <= 11.0.26

Apache Tomcat 10.1.27 <= 10.1.60

Apache Tomcat 9.0.92 <= 9.0.122

References

https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1j...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wentao He
.