CVE-2026-88041 in Tomcat
Summary
by MITRE • 10/20/2026
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.
This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability described constitutes a significant information disclosure flaw within Apache Tomcat, specifically affecting versions from 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122. This issue stems from an incomplete cleanup process in the HTTP request parsing logic, which fails to properly reset or clear internal state variables associated with trailer headers after a request is processed. In HTTP/1.1, trailers are optional header fields that appear at the end of a message body, typically used for chunked transfer encoding. The flaw allows residual data from these trailers in one request to persist in memory and subsequently leak into the processing context of a following request handled by the same thread or connection pool component. This behavior violates the fundamental principle of state isolation between distinct HTTP transactions, creating a pathway for sensitive information leakage across different user sessions or application contexts within the same Tomcat instance.
From a technical perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and more specifically CWE-613: Insufficient Session Expiration when considering the persistence of stateful data beyond its intended lifecycle. The root cause lies in the failure to properly nullify or reset references to trailer-related objects after a request completes, allowing subsequent requests that reuse internal buffers or parser states to inadvertently access stale data. This is particularly dangerous because trailers can contain arbitrary key-value pairs defined by applications or proxies, meaning they may hold authentication tokens, session identifiers, private headers from upstream load balancers, or other confidential metadata. An attacker who can control the content of trailer fields in one request could potentially observe this information in a subsequent response if that response is processed using reused internal state structures, effectively bypassing standard access controls and isolation mechanisms designed to separate user data.
The operational impact of this vulnerability includes unauthorized disclosure of sensitive application headers or proxy metadata, which can facilitate further attacks such as session hijacking, privilege escalation, or targeted phishing campaigns if the leaked information reveals internal architecture details like backend server addresses or authentication schemes. Attackers may exploit this by crafting malicious HTTP requests with specific trailer configurations and then monitoring responses to subsequent legitimate requests from other users that happen to be processed in a way that exposes the previously stored trailer data. This cross-request leakage undermines the confidentiality guarantees expected in web application environments, potentially violating compliance requirements such as GDPR or HIPAA if personal identifiable information is inadvertently exposed through header fields. The severity of this issue depends heavily on whether trailers are actively used by deployed applications and whether those trailers contain sensitive values, but given its potential to leak arbitrary data across request boundaries, it warrants immediate attention from security teams managing affected Tomcat instances.
To mitigate this risk, organizations running vulnerable versions of Apache Tomcat should upgrade immediately to version 11.0.27, 10.1.61, or 9.0.123, where the incomplete cleanup logic has been corrected to ensure proper state reset between requests. Until an upgrade is feasible, administrators can implement compensating controls such as configuring reverse proxies like Nginx or Apache HTTP Server in front of Tomcat to strip trailer headers before they reach the application server, thereby preventing the injection of potentially malicious or sensitive data into the vulnerable parsing logic. Additionally, enabling strict request validation and ensuring that applications do not rely on trailers for critical security decisions can reduce the attack surface. Monitoring logs for unusual patterns in header processing may also help detect exploitation attempts, although this vulnerability is primarily exploitable through controlled input rather than passive observation. Regular patching cycles and adherence to vendor-recommended version upgrades remain the most effective long-term defense against such state management flaws.