CVE-2026-88041
Received Received - Intake

Incomplete Cleanup Information Leak in Apache Tomcat

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-88041
EUVD
EUVD-2026-105007

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Tomcat 11.0.0-M23
Apache Software Foundation Apache Tomcat 10.1.27
Apache Software Foundation Apache Tomcat 9.0.92

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Tomcat is an incomplete cleanup issue where trailer information from one request can leak into another request. This happens because Tomcat fails to properly clear certain data between requests, allowing sensitive or unintended information to persist.

Impact Analysis

The impact includes potential data leakage between requests, which could expose sensitive information such as session tokens, cookies, or other request headers. This may lead to unauthorized access or information disclosure if exploited by an attacker.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing personal or sensitive data. Organizations may face penalties for failing to protect such data, especially if the leakage results in unauthorized access or data breaches.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.27, 10.1.61, or 9.0.123 or later to address the incomplete cleanup vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart