Loading vulnerability…
HTTP/2 Trailer Information Leakage in Apache Tomcat
CVE-2026-88041 is an incomplete-cleanup vulnerability in Apache Tomcat's HTTP/2 processing that allows trailer header information from a previous request to leak into a subsequent request. It affects Tomcat 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122. Apache rates the vulnerability as Low severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Trailer header information associated with an earlier HTTP/2 request can become exposed in a later request, compromising the confidentiality and isolation of request metadata. The sensitivity of the disclosure depends on the information carried in the trailers. Code execution, authentication bypass, and availability impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Apply the fixed release for the deployed Tomcat branch.
Patch, then assume compromise.
Upgrade to Apache Tomcat 11.0.27 or later, 10.1.61 or later, or 9.0.123 or later within the corresponding release branch. For distribution packages without a planned fix, migrate to a supported package or deployment containing a fixed Tomcat release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.