CVE-2026-88041

A flaw was found in Apache Tomcat. Due to an incomplete cleanup vulnerability, HTTP (Hypertext Transfer Protocol) trailer headers from a previous request can persist and leak into a subsequent request processed on the same connection. This issue may allow a remote user to access sensitive request data belonging to another client, resulting in information disclosure.

A flaw was found in Apache Tomcat. Due to incomplete object cleanup during request recycling, HTTP trailer headers from an earlier request can persist and leak into a subsequent request processed on the same persistent connection. An unauthenticated remote attacker sharing a connection pool or backend keep-alive channel could potentially access sensitive trailer metadata sent by other clients, resulting in minor information disclosure within the context of the running Tomcat server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request.