AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-88041

Apache Tomcat: incomplete cleanup

Apache Software Foundation

CVE-2026-88041 · Published Oct 20, 2026 · updated Oct 29, 2026

High7.5
No fix yet
Apache Software Foundation advisory

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.

This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Affected versions

PackageAffectedFixed in
Apache Tomcat
Product
>= 11.0.0-M23, <= 11.0.26No fix yet
>= 10.1.27, <= 10.1.60No fix yet
>= 9.0.92, <= 9.0.122No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-459

More Apache Software Foundation advisories

All Apache Software Foundation
High 7.5Oct 20Apache Tomcat: incomplete cleanupCVE-2026-93446no fix yetHigh 8.1Oct 20Apache Tomcat: race conditionCVE-2026-80353no fix yetMedium 6.5Oct 20Not Failing Securely ('Failing Open') vulnerability in Apache TomcatCVE-2026-74048no fix yetMedium 6.1Oct 20Execution After Redirect (EAR) vulnerability in Apache TomcatCVE-2026-74049no fix yetHigh 7.5Oct 20Apache Cocoon: server-side request forgeryCVE-2026-108086no fix yetHigh 8.8Oct 20Apache Cocoon: SQL injectionCVE-2026-108087no fix yet