Apache Tomcat CVE-2026-88041

Exploitation requires that HTTP requests include trailer fields (chunked transfer-encoding with trailers) and that the TCP connection is reused (keep-alive/persistent connections) so that uncleaned trailer state from a prior request carries into a subsequent one - most ordinary HTTP clients do not send trailers, which materially limits real-world exposure. Impact is bounded to leakage of trailer information rather than full request bodies, headers, or credentials. Affected only on Tomcat 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122; patched builds (11.0.27/10.1.61/9.0.123) are not exploitable. No authentication state can be confirmed because no CVSS vector was provided.

No CVSS score or vector is provided in the input (CVSS Score: N/A, CVSS Vector: N/A), so attack vector, complexity, and privilege requirements cannot be confirmed from vendor/NVD data and must be inferred from the description. The flaw (CWE-459, incomplete cleanup) is an information-disclosure issue where HTTP trailer data from a prior request leaks into a subsequent request on a reused connection - inherently network-reachable but limited to leaking trailer content, not arbitrary memory or credentials, implying low confidentiality impact. No EPSS score, no CISA KEV listing, and no POC indicator are present, so there is no public exploit identified at time of analysis and no signal of active exploitation. Exploitation realistically requires that clients actually use HTTP trailers (uncommon in typical deployments) and that connections are reused, raising effective attack complexity. Net: despite Apache Tomcat's large footprint, this presents as a lower-priority information leak rather than a widespread high-risk issue - the absence of a CVSS vector and any exploitation telemetry should be noted as a data gap, and severity should be verified against the Apache advisory.

An attacker who can send requests over a persistent/keep-alive connection to a vulnerable Tomcat instance crafts traffic such that trailer fields from one request are not cleaned up and bleed into the parsing context of a following request on the same connection. In a shared or proxied connection scenario, this could expose trailer information belonging to another request/user. No public exploit code is identified at time of analysis, and exploitation depends on HTTP trailers actually being in use.