On Sat, Mar 13, 2021 at 9:16 AM Andrew Marlow <marlow.age...@gmail.com> wrote:
> Hello everyone, > > It seems to be quiet in this mailing list and the last version of the > library is 1.2.5 released in 2015. I am surprised that there have been no > other releases, given that several medium severity CVEs have been filed > against the library. Is this the right place to discuss such issues? I > couldn't see a dev mailing list. > The Tomcat dev list would be the place to reach out. http://tomcat.apache.org/lists.html#tomcat-dev
