An incomplete cleanup in Apache Tomcat allows trailer headers from a previous HTTP/2 request to be leaked into a subsequent request, potentially exposing sensitive data that should have been cleared. This defect is categorized as CWE-459, improper release of resources, and can result in confidentiality loss of data contained in HTTP trailer headers.

Apache Tomcat versions 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122 running on any platform supported by the Apache Software Foundation are affected. The vulnerability affects all deployments that enable HTTP/2 and use trailer headers.

The CVSS score is 7.5 and the EPSS score is less than 1%; the vulnerability is not listed in the CISA KEV catalog, indicating limited observed exploitation. The likely attack vector involves sending crafted HTTP/2 requests with trailer headers; the leak can occur regardless of network topology, affecting either internal or external traffic if HTTP/2 is exposed. While no public exploit code is cited, the confidentiality impact and potential for cross‑request data contamination warrant prompt remediation.