Vulnpedia
← Search CVEs

CVE-2026-88041

N/A

Published 2026-10-20 · Last modified 2026-10-20

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 16th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation

Products Apache Tomcat

Weakness (CWE)

  • CWE-459: Incomplete cleanup

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

Showing 32 of 153 vendor product statements; 121 omitted. Read the full vendor advisory.

  • tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-lib as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-lib

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat9 as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat9-lib as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9-lib

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-servlet-4.0-api

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-servlet-4.0-api

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • jws6-tomcat-docs-webapp as a component of Red Hat JBoss Web Server 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws6-tomcat-docs-webapp

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • jws6-tomcat-lib as a component of Red Hat JBoss Web Server 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws6-tomcat-lib

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • jws7-tomcat.src as a component of Red Hat JBoss Web Server 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws7-tomcat?arch=src

    • workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.
    • none available: Fix deferred
    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat6 as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6-jsp-2.1-api

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat6-webapps as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6-webapps

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-el-2.2-api

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-servlet-3.0-api

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • pki-servlet-engine.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/pki-servlet-engine?arch=src&rpmmod=pki-deps:10.6

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • hi/tomcat as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • jws5-tomcat-java-jdk11 as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat-java-jdk11

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • jws5-tomcat-jsvc as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat-jsvc

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00
  • jws5-tomcat.src as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat?arch=src

    Red Hat · CVE-2026-88041 · Updated 2026-10-21T18:51:55+00:00

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS