dev  

Messages by Thread

• [SECURITY] CVE-2026-66299 Apache Tomcat - DoS via WebSocket chat example Mark Thomas
  • Re: [SECURITY] CVE-2026-66299 Apache Tomcat - DoS via WebSocket chat example Mark Thomas
• svn commit: r1936671 - in tomcat/site/trunk: docs xdocs markt
• (tomcat) branch 9.0.x updated: Limit number of messages in per client buffer markt
• (tomcat) branch 10.1.x updated: Limit number of messages in per client buffer markt
• (tomcat) branch 11.0.x updated: Limit number of messages in per client buffer markt
• (tomcat) branch main updated: Limit number of messages in per client buffer markt
• [Bug 70163] New: Missing null check for findManagedBean result in StoreConfigLifecycleListener bugzilla
  • [Bug 70163] Missing null check for findManagedBean result in StoreConfigLifecycleListener bugzilla
  • [Bug 70163] Missing null check for findManagedBean result in StoreConfigLifecycleListener bugzilla
  • [Bug 70163] Missing null check for findManagedBean result in StoreConfigLifecycleListener bugzilla
  • [Bug 70163] Missing null check for findManagedBean result in StoreConfigLifecycleListener bugzilla
• [Bug 70162] New: Fix potential ArrayIndexOutOfBoundsException in JSONParser.generateParseException() bugzilla
  • [Bug 70162] Fix potential ArrayIndexOutOfBoundsException in JSONParser.generateParseException() bugzilla
• [PR] Improve defensive programming and modernize code in Import.processFile() [tomcat] via GitHub
  • Re: [PR] Improve defensive programming and modernize code in Import.processFile() [tomcat] via GitHub
  • Re: [PR] Improve defensive programming and modernize code in Import.processFile() [tomcat] via GitHub
• JDK 27 Rampdown Phase is Closing / Default G1 in All Environments David Delabassee via dev
• (tomcat) branch 9.0.x updated: Refactor to reduce duplication markt
• (tomcat) branch 10.1.x updated: Refactor to reduce duplication markt
• (tomcat) branch 11.0.x updated: Refactor to reduce duplication markt
• (tomcat) branch main updated: Refactor to reduce duplication markt
• (tomcat) branch 9.0.x updated: Better SSLValve docs markt
• (tomcat) branch 10.1.x updated: Better SSLValve docs markt
• (tomcat) branch 11.0.x updated: Better SSLValve docs markt
• (tomcat) branch main updated: Better SSLValve docs markt
• (tomcat) branch 9.0.x updated: Stricter URI template matching for WebSocket markt
• (tomcat) branch 10.1.x updated: Stricter URI template matching for WebSocket markt
• (tomcat) branch 11.0.x updated: Stricter URI template matching for WebSocket markt
• (tomcat) branch main updated: Stricter URI template matching for WebSocket markt
• (tomcat) branch 9.0.x updated: Register the use of an HTTP/2 stream identifier earlier. markt
• (tomcat) branch 10.1.x updated: Register the use of an HTTP/2 stream identifier earlier. markt
• (tomcat) branch 11.0.x updated: Register the use of an HTTP/2 stream identifier earlier. markt
• (tomcat) branch main updated: Register the use of an HTTP/2 stream identifier earlier. markt
• (tomcat) branch 9.0.x updated: Update Maven Resolver Ant Tasks to 1.6.1. rjung
• (tomcat) branch 10.1.x updated: Update Maven Resolver Ant Tasks to 1.6.1. rjung
• (tomcat) branch 11.0.x updated: Update Maven Resolver Ant Tasks to 1.6.1. rjung
• (tomcat) branch main updated: Update Maven Resolver Ant Tasks to 1.6.1. rjung
• [PR] improve startup perf [tomcat] via GitHub
  • Re: [PR] improve startup perf [tomcat] via GitHub
  • Re: [PR] improve startup perf [tomcat] via GitHub
• (tomcat) branch main updated: Separate the Context role mapping from security-role-ref remm
• (tomcat) branch 9.0.x updated: Separate the Context role mapping from security-role-ref remm
• (tomcat) branch 10.1.x updated: Separate the Context role mapping from security-role-ref remm
• (tomcat) branch 11.0.x updated: Separate the Context role mapping from security-role-ref remm
• (tomcat) branch 9.0.x updated: Add limit to HTTP response header size in upgrade to WebSocket markt
• (tomcat) branch 10.1.x updated: Add limit to HTTP response header size in upgrade to WebSocket markt
• (tomcat) branch 11.0.x updated: Add limit to HTTP response header size in upgrade to WebSocket markt
• (tomcat) branch main updated: Add limit to HTTP response header size in upgrade to WebSocket markt
• (tomcat) branch 11.0.x updated: Tomcat 11 implements Servlet 6.1 (not 6.0) markt
• [Bug 70160] New: Tomcat 11, Servlet 6.1 not 6.0 in documentation Introduction bugzilla
  • [Bug 70160] Tomcat 11, Servlet 6.1 not 6.0 in documentation Introduction bugzilla
• (tomcat) branch 9.0.x updated: Fix incorrect rejection at upper boundary of nonceCount window markt
• (tomcat) branch 10.1.x updated: Fix incorrect rejection at upper boundary of nonceCount window markt
• (tomcat) branch 11.0.x updated: Fix incorrect rejection at upper boundary of nonceCount window markt
• (tomcat) branch main updated: Fix incorrect rejection at upper boundary of nonceCount window markt
• (tomcat) branch 9.0.x updated: Require an authority for HTTP/2 requests markt
• (tomcat) branch 10.1.x updated: Require an authority for HTTP/2 requests markt
• (tomcat) branch 11.0.x updated: Require an authority for HTTP/2 requests markt
• (tomcat) branch main updated: Require an authority for HTTP/2 requests markt
• (tomcat) branch 9.0.x updated: Align getContent() behaviour markt
• (tomcat) branch 10.1.x updated: Align getContent() behaviour markt
• (tomcat) branch 11.0.x updated: Align getContent() behaviour markt
• (tomcat) branch main updated: Align getContent() behaviour markt
• (tomcat) branch 10.1.x updated: Improve description of highConcurrencyStatus markt
• (tomcat) branch 9.0.x updated: Improve description of highConcurrencyStatus markt
• (tomcat) branch 11.0.x updated: Improve description of highConcurrencyStatus markt
• (tomcat) branch main updated: Improve description of highConcurrencyStatus markt
• (tomcat) branch 9.0.x updated: Simplify code markt
• (tomcat) branch 10.1.x updated: Simplify code markt
• (tomcat) branch 11.0.x updated: Simplify code markt
• (tomcat) branch main updated: Simplify code markt
• [Bug 69967] ServletResponse#getHeader does not check contentType field bugzilla
  • [Bug 69967] ServletResponse#getHeader does not check contentType field bugzilla
• (tomcat) branch 10.1.x updated: Follow-up to parsing improvements markt
• (tomcat) branch 9.0.x updated: Follow-up to parsing improvements markt
• (tomcat) branch 11.0.x updated: Follow-up to parsing improvements markt
• (tomcat) branch main updated: Follow-up to parsing improvements markt
• (tomcat) branch 9.0.x updated: Remove unnecessary code. markt
• (tomcat) branch 10.1.x updated: Remove unnecessary code. markt
• (tomcat) branch 11.0.x updated: Remove unnecessary code. markt
• (tomcat) branch main updated: Remove unnecessary code. markt
• (tomcat) branch 9.0.x updated: Restore type as it is required when targetting Java 8 markt
• (tomcat) branch 9.0.x updated: Fix regression in handling of chain rules markt
• (tomcat) branch 10.1.x updated: Fix regression in handling of chain rules markt
• (tomcat) branch 11.0.x updated: Fix regression in handling of chain rules markt
• (tomcat) branch main updated: Fix regression in handling of chain rules markt
• (tomcat) branch 9.0.x updated: Handle maxSavePostSize=0 case for HTTP/1.1 to HTTP/2 upgrade with body markt
• (tomcat) branch 10.1.x updated: Handle maxSavePostSize=0 case for HTTP/1.1 to HTTP/2 upgrade with body markt
• (tomcat) branch 11.0.x updated: Handle maxSavePostSize=0 case for HTTP/1.1 to HTTP/2 upgrade with body markt
• (tomcat) branch main updated: Handle maxSavePostSize=0 case for HTTP/1.1 to HTTP/2 upgrade with body markt
• (tomcat) branch 9.0.x updated: Correctly split literal "]]>" if it appears in CDATA markt
• (tomcat) branch 11.0.x updated: Correctly split literal "]]>" if it appears in CDATA markt
• (tomcat) branch 10.1.x updated: Correctly split literal "]]>" if it appears in CDATA markt
• (tomcat) branch main updated: Correctly split literal "]]>" if it appears in CDATA markt
• (tomcat) branch 9.0.x updated: Fix equals() and hashCode(). Need to use pattern string. markt
• (tomcat) branch 10.1.x updated: Fix equals() and hashCode(). Need to use pattern string. markt
• (tomcat) branch 11.0.x updated: Fix equals() and hashCode(). Need to use pattern string. markt
• (tomcat) branch main updated: Fix equals() and hashCode(). Need to use pattern string. markt
• (tomcat) branch 9.0.x updated: Always call ExceptionUtils.handleThrowable first in a catch block markt
• (tomcat) branch 10.1.x updated: Always call ExceptionUtils.handleThrowable first in a catch block markt
• (tomcat) branch 11.0.x updated: Always call ExceptionUtils.handleThrowable first in a catch block markt
• (tomcat) branch main updated: Always call ExceptionUtils.handleThrowable first in a catch block markt
• (tomcat) branch 9.0.x updated: Fix IDE warning markt
• (tomcat) branch 10.1.x updated: Fix IDE warning markt
• (tomcat) branch 11.0.x updated: Fix IDE warning markt
• (tomcat) branch 9.0.x updated: Add escaping for context path and current/parent dir names. markt
• (tomcat) branch 11.0.x updated: Add escaping for context path and current/parent dir names. markt
• (tomcat) branch 10.1.x updated: Add escaping for context path and current/parent dir names. markt
• (tomcat) branch main updated: Add escaping for context path and current/parent dir names. markt
• [Bug 50016] bad division of responsibility around isUserInRole and new Request login and logout methods bugzilla
• [Bug 70147] New: Unable to build Tomcat 10.1.57 with Java 21 bugzilla
  • [Bug 70147] Unable to build Tomcat 10.1.57 with Java 21 bugzilla
  • [Bug 70147] Unable to build Tomcat 10.1.57 with Java 21 bugzilla
  • [Bug 70147] Unable to build Tomcat 10.1.57 with Java 21 bugzilla
• (tomcat) branch 10.1.x updated: Redo parsing since not fully accurate with tokenizer remm
• (tomcat) branch 9.0.x updated: Redo parsing since not fully accurate with tokenizer remm
• (tomcat) branch 11.0.x updated: Redo parsing since not fully accurate with tokenizer remm
• (tomcat) branch main updated: Redo parsing since not fully accurate with tokenizer remm
• (tomcat) branch 9.0.x updated: Add changelog remm
• (tomcat) branch 10.1.x updated: Add changelog remm
• (tomcat) branch 11.0.x updated: Add changelog remm
• (tomcat) branch main updated: Add changelog remm
• (tomcat) branch 9.0.x updated: Fix some issues with rewrite processing from code review remm
• (tomcat) branch 10.1.x updated: Fix some issues with rewrite processing from code review remm
• (tomcat) branch 11.0.x updated: Fix some issues with rewrite processing from code review remm
• (tomcat) branch main updated: Fix some issues with rewrite processing from code review remm
• (tomcat) branch 9.0.x updated: Add reason remm
• (tomcat) branch 10.1.x updated: Add reason remm
• (tomcat) branch 11.0.x updated: Add reason remm
• (tomcat) branch main updated: Add reason remm
• New severity for security reports Mark Thomas
  • Re: New severity for security reports Rémy Maucherat
  • Re: New severity for security reports Tim Funk
  • Re: New severity for security reports Mark Thomas
  • Re: New severity for security reports Christopher Schultz
• [Bug 70144] New: Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
  • [Bug 70144] Tomcat Embedded doesn't work with encoded `\` bugzilla
• (tomcat-maven-plugin) branch dependabot/maven/tomcatVersion-11.0.24 created (now 5685b3b) github-bot
• [PR] Bump tomcatVersion from 9.0.117 to 11.0.24 [tomcat-maven-plugin] via GitHub
• (tomcat) branch 9.0.x updated: Handle InvalidFileNameException when parsing parts remm
• (tomcat) branch 10.1.x updated: Handle InvalidFileNameException when parsing parts remm
• (tomcat) branch 11.0.x updated: Handle InvalidFileNameException when parsing parts remm
• (tomcat) branch main updated: Handle InvalidFileNameException when parsing parts remm
• [Bug 70143] New: InvalidFileNameException thrown when only IllegalStateException is expected when uploading file bugzilla
  • [Bug 70143] InvalidFileNameException thrown when only IllegalStateException is expected when uploading file bugzilla
• [SECURITY] CVE-2026-59084 Apache Tomcat - EncryptInterceptor requirements not clearly documented Mark Thomas
• [SECURITY] CVE-2026-59083 Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Mark Thomas
• svn commit: r1936127 - in tomcat/site/trunk: docs xdocs markt
• Re: [PR] Adds the possibility to change the USE_TLS_RESPONSE HTTP response [tomcat] via GitHub
• [Bug 68596] Remaining overhead in javax.el.CompositeELResolver.convertToType bugzilla
  • [Bug 68596] Remaining overhead in javax.el.CompositeELResolver.convertToType bugzilla
• (tomcat) branch 10.1.x updated: Refactor using Mark's template remm
• (tomcat) branch 9.0.x updated: Refactor using Mark's template remm
• (tomcat) branch 11.0.x updated: Refactor using Mark's template remm
• (tomcat) branch main updated: Refactor using Mark's template remm
• (tomcat) branch 9.0.x updated: Fix from further review remm
• (tomcat) branch 10.1.x updated: Fix from further review remm
• (tomcat) branch 11.0.x updated: Fix from further review remm
• (tomcat) branch main updated: Fix from further review remm
• svn commit: r1936041 - tomcat/site/trunk/docs markt
• [ANN] Apache Tomcat 10.1.57 Available Christopher Schultz
• (tomcat) branch 9.0.x updated: Avoid IDE warning. Detect invalid offset. Better exception messages. markt
• (tomcat) branch 10.1.x updated: Avoid IDE warning. Detect invalid offset. Better exception messages. markt
• (tomcat) branch 11.0.x updated: Avoid IDE warning. Detect invalid offset. Better exception messages. markt
• (tomcat) branch main updated: Avoid IDE warning. Detect invalid offset. Better exception messages. markt
• (tomcat) branch 11.0.x updated: Use Eclipse generated hashCode() and equals() with some modifications markt
• (tomcat) branch 9.0.x updated: Use Eclipse generated hashCode() and equals() with some modifications markt
• (tomcat) branch 10.1.x updated: Use Eclipse generated hashCode() and equals() with some modifications markt
• (tomcat) branch main updated: Use Eclipse generated hashCode() and equals() with some modifications markt
  • Re: (tomcat) branch main updated: Use Eclipse generated hashCode() and equals() with some modifications Christopher Schultz
• (tomcat) branch 9.0.x updated: No need to notify if there was no entry to remove markt
• (tomcat) branch 10.1.x updated: No need to notify if there was no entry to remove markt
• (tomcat) branch 11.0.x updated: No need to notify if there was no entry to remove markt
• (tomcat) branch 10.1.x updated: Consider value as well as key in equals() markt
• (tomcat) branch main updated: No need to notify if there was no entry to remove markt
• (tomcat) branch 9.0.x updated: Consider value as well as key in equals() markt
• (tomcat) branch 11.0.x updated: Consider value as well as key in equals() markt
• (tomcat) branch main updated: Consider value as well as key in equals() markt
• (tomcat) branch 9.0.x updated: Ensure internal state is reset before re-using ELParser markt
• (tomcat) branch 10.1.x updated: Ensure internal state is reset before re-using ELParser markt
• (tomcat) branch 11.0.x updated: Ensure internal state is reset before re-using ELParser markt
• (tomcat) branch main updated: Ensure internal state is reset before re-using ELParser markt
• [Bug 70141] New: Shell Command Injection via CGIServlet Argument Injection on Linux bugzilla
  • [Bug 70141] Shell Command Injection via CGIServlet Argument Injection on Linux bugzilla
  • [Bug 70141] Shell Command Injection via CGIServlet Argument Injection on Linux bugzilla
• (tomcat) branch 9.0.x updated: Extend filtering to include dynamic proxy interface classes markt
• (tomcat) branch 10.1.x updated: Extend filtering to include dynamic proxy interface classes markt
• (tomcat) branch 11.0.x updated: Extend filtering to include dynamic proxy interface classes markt
• (tomcat) branch main updated: Extend filtering to include dynamic proxy interface classes markt
• (tomcat) branch 9.0.x updated: Remove unnecessary intern() calls. markt
• (tomcat) branch 10.1.x updated: Remove unnecessary intern() calls. markt

• Earlier messages