{"schema":"vulnpedia.research/1","cve":"CVE-2026-88041","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:43:28.681Z","origins":[{"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:43:28.681Z","url":"https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1"},{"source":"nvd","sourceId":"CVE-2026-88041","modified":"2026-10-20T19:34:00.700","url":"https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1"},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/24","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:05.285Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:05.285Z","url":"http://www.openwall.com/lists/oss-security/2026/10/20/24"},{"source":"nvd","sourceId":"CVE-2026-88041","modified":"2026-10-20T19:34:00.700","url":"http://www.openwall.com/lists/oss-security/2026/10/20/24"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88041","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-88041"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556182","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556182"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88041","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-88041"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88041","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88041"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:85926","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://access.redhat.com/errata/RHSA-2026:85926"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:81365","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://access.redhat.com/errata/RHSA-2026:81365"}]},{"source":"euvd","sourceId":"EUVD-2026-105007","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105007","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-105007","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105007"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat10@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat10-admin-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat10-docs-webapp@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat10-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat11-admin-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat11-docs-webapp@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat11-jsp-4.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat11-servlet-6.1-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"Red Hat Hardened Images:tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."}],"purl":"pkg:rpm/redhat/tomcat11-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_10:tomcat","product":"tomcat as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_10:tomcat-lib","product":"tomcat-lib as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_10:tomcat9","product":"tomcat9 as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat9","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_10:tomcat9-lib","product":"tomcat9-lib as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat9-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_8:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_8:tomcat-servlet-4.0-api","product":"tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-servlet-4.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_9:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_9:tomcat-servlet-4.0-api","product":"tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-servlet-4.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-docs-webapp","product":"jws6-tomcat-docs-webapp as a component of Red Hat JBoss Web Server 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws6-tomcat-docs-webapp","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-lib","product":"jws6-tomcat-lib as a component of Red Hat JBoss Web Server 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws6-tomcat-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_jboss_web_server_7:jws7-tomcat.src","product":"jws7-tomcat.src as a component of Red Hat JBoss Web Server 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests=\"1\" on Tomcat HTTP connectors to force separate connections for each request."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws7-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_6:tomcat6","product":"tomcat6 as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_6:tomcat6-jsp-2.1-api","product":"tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_6:tomcat6-webapps","product":"tomcat6-webapps as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_7:tomcat-el-2.2-api","product":"tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-el-2.2-api","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_7:tomcat-servlet-3.0-api","product":"tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-servlet-3.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_enterprise_linux_8:pki-servlet-engine.src::pki-deps:10.6","product":"pki-servlet-engine.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/pki-servlet-engine?arch=src&rpmmod=pki-deps:10.6","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_hardened_images:hi/tomcat","product":"hi/tomcat as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-java-jdk11","product":"jws5-tomcat-java-jdk11 as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat-java-jdk11","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-jsvc","product":"jws5-tomcat-jsvc as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat-jsvc","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]},{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat.src","product":"jws5-tomcat.src as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-88041","modified":"2026-10-21T18:51:55+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88041.json"}]}],"vendorCoverage":{"total":153,"shown":32,"omitted":121,"source":"redhat"}}