dev  

Messages by Thread

• Rough plan for September releases Mark Thomas
• (tomcat) branch 11.0.x updated: Skip certificate logging if SSLContext is null remm
• (tomcat-native) branch 1.3.x updated: Harden against the mis-use of Pool.destroy(long) markt
• (tomcat-native) branch main updated: Harden against the mis-use of Pool.destroy(long) markt
• (tomcat-native) branch 1.3.x updated: Harden against mis-use markt
• (tomcat-native) branch main updated: Harden against mis-use markt
• (tomcat-native) branch main updated: Another robustness improvement for OCSP responses. markt
• (tomcat-native) branch 1.3.x updated: Another robustness improvement for OCSP responses. markt
• (tomcat-native) branch 1.3.x updated (4a70b839f -> 002d33b7e) markt
  • (tomcat-native) 02/02: Stricter OCSP handling when soft-fail is disabled. markt
  • (tomcat-native) 01/02: Make the processing of OCSP responses more robust markt
• (tomcat-native) branch main updated: Stricter OCSP handling when soft-fail is disabled. markt
• (tomcat-native) branch main updated: Make the processing of OCSP responses more robust markt
• (tomcat-native) branch 1.3.x updated: Further robustness improvements to OCSP AIA parsing markt
• (tomcat-native) branch main updated: Further robustness improvements to OCSP AIA parsing markt
• (tomcat) branch main updated: Skip certificate logging if SSLContext is null remm
• (tomcat) branch 9.0.x updated: Skip certificate logging if SSLContext is null remm
• (tomcat) branch 10.1.x updated: Skip certificate logging if SSLContext is null remm
• (tomcat-native) branch 1.3.x updated: Avoid a potential crash when processing OCSP URLs. markt
• (tomcat-native) branch main updated: Avoid a potential crash when processing OCSP URLs. markt
• (tomcat) branch 9.0.x updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
• (tomcat) branch 10.1.x updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
• (tomcat) branch 11.0.x updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
• (tomcat) branch main updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
  • Re: (tomcat) branch main updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" Rémy Maucherat
• (tomcat) branch 10.1.x updated: Clarify the meaning of various RewriteValve server variables markt
• (tomcat) branch 9.0.x updated: Clarify the meaning of various RewriteValve server variables markt
• (tomcat) branch 11.0.x updated: Clarify the meaning of various RewriteValve server variables markt
• (tomcat) branch main updated: Clarify the meaning of various RewriteValve server variables markt
• (tomcat) branch 9.0.x updated: Avoid some scenarios of expiration of never expire sessions remm
• (tomcat) branch 10.1.x updated: Avoid some scenarios of expiration of never expire sessions remm
• (tomcat) branch 11.0.x updated: Avoid some scenarios of expiration of never expire sessions remm
• (tomcat) branch main updated: Avoid some scenarios of expiration of never expire sessions remm
• (tomcat) branch 9.0.x updated: Tweak the bloom filter for the root remm
• (tomcat) branch 10.1.x updated: Tweak the bloom filter for the root remm
• (tomcat) branch 11.0.x updated: Tweak the bloom filter for the root remm
• (tomcat) branch main updated: Tweak the bloom filter for the root remm
• (tomcat) branch 9.0.x updated: Add some clarification to the comments remm
• (tomcat) branch 10.1.x updated: Add some clarification to the comments remm
• (tomcat) branch 11.0.x updated: Add some clarification to the comments remm
• (tomcat) branch main updated: Add some clarification to the comments remm
• (tomcat) branch 9.0.x updated: Add best efforts protection for a mis-configured Valve markt
• (tomcat) branch 10.1.x updated: Add best efforts protection for a mis-configured Valve markt
• (tomcat) branch 11.0.x updated: Add best efforts protection for a mis-configured Valve markt
• (tomcat) branch main updated: Add best efforts protection for a mis-configured Valve markt
• (tomcat-native) branch 1.3.x updated: Make the call to a CertificateVerifier more robust markt
• (tomcat-native) branch main updated: Make the call to a CertficateVerifier more robust markt
• (tomcat-native) branch 1.3.x updated: Avoid a potential crash with very long ALPN protocol names markt
• (tomcat-native) branch main updated: Avoid a potential crash with very long ALPN protocol names markt
• (tomcat-native) branch 1.3.x updated: Fix a potential crash when configuring raw certificates. markt
• (tomcat-native) branch main updated: Fix a potential crash when configuring raw certificates. markt
• (tomcat-native) branch 1.3.x updated: Keep connection and context verification settings separate markt
• (tomcat-native) branch main updated: Keep connection and context verification settings separate markt
• (tomcat-native) branch 1.3.x updated: Add missing UNREFERENCED() handling markt
• (tomcat-native) branch 1.3.x updated: Remove unused parameters markt
• (tomcat-native) branch 1.3.x updated: Remove unused macros markt
  • (tomcat-native) branch 1.3.x updated: Remove unused macros markt
• (tomcat-native) branch 1.3.x updated: Remove unused code markt
  • (tomcat-native) branch 1.3.x updated: Remove unused code markt
• (tomcat-native) branch 1.3.x updated: Fix copy/paste error markt
• (tomcat-native) branch 1.3.x updated: Remove unused JNI exports markt
• (tomcat-native) branch 1.3.x updated (77a879910 -> 093f672dc) markt
  • (tomcat-native) 04/06: Remove unused code markt
  • (tomcat-native) 03/06: Remove unused code markt
  • (tomcat-native) 06/06: Remove unused code markt
  • (tomcat-native) 05/06: Remove unused code markt
  • (tomcat-native) 02/06: Remove unused code markt
  • (tomcat-native) 01/06: Remove unused code markt
• (tomcat-native) branch main updated: Remove more unused code markt
• (tomcat-native) branch main updated: Remove remaining unused types markt
• (tomcat-native) branch main updated: Remove remaining unused structure members markt
• (tomcat-native) branch main updated: Remove remaining unused declarations markt
• (tomcat-native) branch main updated: Remove remaining unused functions markt
• (tomcat) branch main updated (d3c07eec82 -> 91f7934cf3) markt
  • (tomcat) 01/02: Remove deprecated code markt
  • (tomcat) 02/02: Deprecate unused code markt
• [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
  • Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
• (tomcat) branch 9.0.x updated: Deprecate unused code markt
  • (tomcat) branch 9.0.x updated: Deprecate unused code markt
• (tomcat) branch 9.0.x updated: Deprecate unused code and update deprecation info markt
• (tomcat) branch 10.1.x updated: Deprecate unused code markt
  • (tomcat) branch 10.1.x updated: Deprecate unused code markt
  • (tomcat) branch 10.1.x updated: Deprecate unused code markt
• (tomcat) branch 11.0.x updated: Deprecate unused code markt
  • (tomcat) branch 11.0.x updated: Deprecate unused code markt
  • (tomcat) branch 11.0.x updated: Deprecate unused code markt
• (tomcat) branch main updated: Deprecate unused code markt
  • (tomcat) branch main updated: Deprecate unused code markt
• (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
  • (tomcat-native) branch main updated: Remove unused code markt
• (tomcat-native) branch main updated: Remove dead code markt
• (tomcat) branch 11.0.x updated: Resolve missing back references or variables as empty string remm
• (tomcat) branch 10.1.x updated: Resolve missing back references or variables as empty string remm
• (tomcat) branch 9.0.x updated: Resolve missing back references or variables as empty string remm
• (tomcat) branch main updated: Resolve missing back references or variables as empty string remm
• (tomcat-native) branch 1.3.x updated: Add support for the extended range of options in OpenSSL 3.x onwards markt
• (tomcat-native) branch main updated: Add support for the extended range of options in OpenSSL 3.x onwards markt
• (tomcat-native) branch 1.3.x updated: Fix a potential crash when negotiating ALPN markt
• (tomcat-native) branch 1.3.x updated: Fallback as intended if ALPN negotiation fails. markt
• (tomcat-native) branch main updated (10c98b699 -> 035249cc4) markt
  • (tomcat-native) 02/02: Fallback as intended if ALPN negotiation fails. markt
  • (tomcat-native) 01/02: Fix a potential crash when negotiating ALPN markt
• (tomcat) branch 9.0.x updated: Improve robustness of o.a.c.core package to system clock jumps markt
• (tomcat) branch 10.1.x updated: Improve robustness of o.a.c.core package to system clock jumps markt
• (tomcat) branch 11.0.x updated: Improve robustness of o.a.c.core package to system clock jumps markt
• (tomcat) branch main updated: Improve robustness of o.a.c.core package to system clock jumps markt
• (tomcat) branch 9.0.x updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
• (tomcat) branch 10.1.x updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
• (tomcat) branch 11.0.x updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
• (tomcat) branch main updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
• (tomcat) branch 9.0.x updated: Improve handling of get[Pooled]Connection(String,String) markt
• (tomcat) branch 10.1.x updated: Improve handling of get[Pooled]Connection(String,String) markt
• (tomcat) branch 11.0.x updated: Improve handling of get[Pooled]Connection(String,String) markt
• (tomcat) branch main updated: Improve handling of get[Pooled]Connection(String,String) markt
• (tomcat) branch 9.0.x updated: Try again. markt
  • Re: (tomcat) branch 9.0.x updated: Try again. Coty Sutherland
• Ticketing systems and release/security announcements Mark Thomas
• [SECURITY] CVE-2026-73180 Apache Tomcat - Authenticated WebSocket session survives end of HTTP session Mark Thomas
• [SECURITY] CVE-2026-68763 Apache Tomcat - DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset Mark Thomas
• [SECURITY] CVE-2026-68569 Apache Tomcat - Principal lookup can fail open in some cases Mark Thomas
• [SECURITY] CVE-2026-65927 Apache Tomcat - RewriteValve [N] restarts at the second rule and may bypass access control Mark Thomas
• [SECURITY] CVE-2026-68525 Apache Tomcat - Redirect after FORM authentication may bypass method specific constraints Mark Thomas
• [SECURITY] CVE-2026-66422 Apache Tomcat - Servlet role references can bypass declarative role constraints Mark Thomas
• [SECURITY] CVE-2026-65905 Apache Tomcat - Limited replay attack possible with DIGEST authentication Mark Thomas
• [SECURITY] CVE-2026-65637 Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation Mark Thomas
• [SECURITY] CVE-2026-65183 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets Mark Thomas
• [SECURITY] CVE-2026-65182 Apache Tomcat - Security constraint bypass Mark Thomas
• svn commit: r1937457 - in tomcat/site/trunk: docs xdocs markt
• Buildbot retry in on tomcat-11.0.x buildbot
• (tomcat) branch 11.0.x updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
• (tomcat) branch 9.0.x updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
• (tomcat) branch 10.1.x updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
• (tomcat) branch main updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
• (tomcat) branch 11.0.x updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
• (tomcat) branch 9.0.x updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
• (tomcat) branch 10.1.x updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
• (tomcat) branch main updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
• svn commit: r1937432 - in tomcat/site/trunk: docs xdocs markt
• (tomcat) branch 10.1.x updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
• (tomcat) branch 9.0.x updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
• (tomcat) branch 11.0.x updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
• (tomcat) branch main updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
• [PR] Upgrade actions/setup-java to v6 [tomcat] via GitHub
  • Re: [PR] Upgrade actions/setup-java to v6 [tomcat] via GitHub
  • Re: [PR] Upgrade actions/setup-java to v6 [tomcat] via GitHub
• [PR] Skip tribes membership tests when IP multicast is unavailable rather than fail [tomcat] via GitHub
  • Re: [PR] Skip tribes membership tests when IP multicast is unavailable rather than fail [tomcat] via GitHub
  • Re: [PR] Skip tribes membership tests when IP multicast is unavailable rather than fail [tomcat] via GitHub
• [PR] Skip OCSP tests when responder port is unavailable instead of fail [tomcat] via GitHub
  • Re: [PR] Skip OCSP tests when responder port is unavailable instead of fail [tomcat] via GitHub
  • Re: [PR] Skip OCSP tests when responder port is unavailable instead of fail [tomcat] via GitHub
• (tomcat) branch 9.0.x updated: Prevent session swap out if associated with currently active request markt
• (tomcat) branch 10.1.x updated: Prevent session swap out if associated with currently active request markt
• (tomcat) branch 11.0.x updated: Prevent session swap out if associated with currently active request markt
• (tomcat) branch main updated: Prevent session swap out if associated with currently active request markt
• (tomcat) branch main updated: Fix broken test markt
• [PR] Fix drawboard rendering for axis-aligned shapes [tomcat] via GitHub
• (tomcat) branch 9.0.x updated: Re-apply standard formatting markt
• (tomcat) branch main updated: Drop backwards compatibility implementation markt
• (tomcat) branch 9.0.x updated: Fix concurrency issues with session Store load/save markt
• (tomcat) branch 10.1.x updated: Fix concurrency issues with session Store load/save markt
• (tomcat) branch 11.0.x updated: Fix concurrency issues with session Store load/save markt
• (tomcat) branch main updated: Fix concurrency issues with session Store load/save markt
• (tomcat) branch 11.0.x updated: Re-apply standard formatting markt
• (tomcat) branch 10.1.x updated: Re-apply standard formatting markt
• (tomcat) branch main updated: Code clean-up - re-apply standard formatting markt
• svn commit: r1937284 - in tomcat/site/trunk: docs xdocs markt
• Re-thinking encryption for clustering Mark Thomas
• svn commit: r1937274 - in tomcat/site/trunk: . docs docs/tomcat-10.1-doc docs/tomcat-10.1-doc/annotationapi docs/tomcat-10.1-doc/annotationapi/jakarta/annotation docs/tomcat-10.1-doc/annotationapi/jakarta/annotation/security docs/tomcat-10.1-doc/annota... schultz
• svn commit: r86899 - release/tomcat/tomcat-10/v10.1.57 schultz
• svn commit: r86897 - dev/tomcat/tomcat-10/v10.1.59 release/tomcat/tomcat-10/v10.1.59 schultz
• (tomcat) branch 9.0.x updated: Re-work x-forwarded-proto multiple header fix markt
• (tomcat) branch 10.1.x updated: Re-work x-forwarded-proto multiple header fix markt
• (tomcat) branch 11.0.x updated: Re-work x-forwarded-proto multiple header fix markt
• (tomcat) branch main updated: Re-work x-forwarded-proto multiple header fix markt
• (tomcat) branch 9.0.x updated (ec24533693 -> e992113d2c) markt
  • (tomcat) 02/02: Add some additional validation in RemoteIp[Filter|Valve] markt

• Earlier messages