CVE-2026-88041

The record

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Affected packages

Related vulnerabilities

• CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete… CWE-459
• CVE-2026-115478 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. CWE-459
• CVE-2026-113658 ApostropheCMS is an open-source Node.js content management system. CWE-459
• CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail… CWE-459
• CVE-2026-109869 undici is an HTTP client library for Node.js. CWE-459
• CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw… CWE-459
• CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after… CWE-459
• CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. CWE-459