CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination

As cited

Copy frozen at 2026-10-20 19:25 UTC (site build).

vulnerabilities

CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination

Apache Tomcat contains a cross-contamination vulnerability in HTTP/2 trailer header handling that allows information from a previous request to leak into a subsequent request. The issue affects Tomcat 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122. The vendor has rated the severity as low.

Why it matters: Tomcat administrators running affected versions may inadvertently expose request data (such as session tokens or authentication headers) between client connections due to incomplete cleanup on HTTP/2 connections; update to the patched release available from Apache.

Source published

2026-10-20 17:22 UTC

First seen by Cybersecurity Tracker

2026-10-20 18:31 UTC