dev

Messages by Date

2026/08/28 Rough plan for September releases Mark Thomas
2026/08/28 (tomcat) branch 11.0.x updated: Skip certificate logging if SSLContext is null remm
2026/08/28 (tomcat-native) branch 1.3.x updated: Harden against the mis-use of Pool.destroy(long) markt
2026/08/28 (tomcat-native) branch main updated: Harden against the mis-use of Pool.destroy(long) markt
2026/08/28 (tomcat-native) branch 1.3.x updated: Harden against mis-use markt
2026/08/28 (tomcat-native) branch main updated: Harden against mis-use markt
2026/08/28 (tomcat-native) branch main updated: Another robustness improvement for OCSP responses. markt
2026/08/28 (tomcat-native) branch 1.3.x updated: Another robustness improvement for OCSP responses. markt
2026/08/28 (tomcat-native) 01/02: Make the processing of OCSP responses more robust markt
2026/08/28 (tomcat-native) 02/02: Stricter OCSP handling when soft-fail is disabled. markt
2026/08/28 (tomcat-native) branch 1.3.x updated (4a70b839f -> 002d33b7e) markt
2026/08/28 (tomcat-native) branch main updated: Stricter OCSP handling when soft-fail is disabled. markt
2026/08/28 (tomcat-native) branch main updated: Make the processing of OCSP responses more robust markt
2026/08/28 (tomcat-native) branch 1.3.x updated: Further robustness improvements to OCSP AIA parsing markt
2026/08/28 (tomcat-native) branch main updated: Further robustness improvements to OCSP AIA parsing markt
2026/08/28 (tomcat) branch main updated: Skip certificate logging if SSLContext is null remm
2026/08/28 (tomcat) branch 9.0.x updated: Skip certificate logging if SSLContext is null remm
2026/08/28 (tomcat) branch 10.1.x updated: Skip certificate logging if SSLContext is null remm
2026/08/28 (tomcat-native) branch 1.3.x updated: Avoid a potential crash when processing OCSP URLs. markt
2026/08/28 (tomcat-native) branch main updated: Avoid a potential crash when processing OCSP URLs. markt
2026/08/28 Re: (tomcat) branch main updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" Rémy Maucherat
2026/08/28 (tomcat) branch 9.0.x updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
2026/08/28 (tomcat) branch 10.1.x updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
2026/08/28 (tomcat) branch 11.0.x updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
2026/08/28 (tomcat) branch main updated: Follow-up "Avoid some scenarios of expiration of never expire sessions" markt
2026/08/28 Buildbot success in on tomcat-12.0.x buildbot
2026/08/28 (tomcat) branch 10.1.x updated: Fix IDE warning markt
2026/08/28 (tomcat) branch 9.0.x updated: Fix backport markt
2026/08/28 (tomcat) branch 10.1.x updated: Clarify the meaning of various RewriteValve server variables markt
2026/08/28 (tomcat) branch 9.0.x updated: Clarify the meaning of various RewriteValve server variables markt
2026/08/28 (tomcat) branch 11.0.x updated: Clarify the meaning of various RewriteValve server variables markt
2026/08/28 (tomcat) branch main updated: Clarify the meaning of various RewriteValve server variables markt
2026/08/28 Buildbot failure in on tomcat-12.0.x buildbot
2026/08/28 (tomcat) branch 9.0.x updated: Avoid some scenarios of expiration of never expire sessions remm
2026/08/28 (tomcat) branch 10.1.x updated: Avoid some scenarios of expiration of never expire sessions remm
2026/08/28 (tomcat) branch 11.0.x updated: Avoid some scenarios of expiration of never expire sessions remm
2026/08/28 (tomcat) branch main updated: Avoid some scenarios of expiration of never expire sessions remm
2026/08/28 (tomcat) branch 9.0.x updated: Tweak the bloom filter for the root remm
2026/08/28 (tomcat) branch 10.1.x updated: Tweak the bloom filter for the root remm
2026/08/28 (tomcat) branch 11.0.x updated: Tweak the bloom filter for the root remm
2026/08/28 (tomcat) branch main updated: Tweak the bloom filter for the root remm
2026/08/28 (tomcat) branch 9.0.x updated: Add some clarification to the comments remm
2026/08/28 (tomcat) branch 10.1.x updated: Add some clarification to the comments remm
2026/08/28 (tomcat) branch 11.0.x updated: Add some clarification to the comments remm
2026/08/28 (tomcat) branch main updated: Add some clarification to the comments remm
2026/08/28 (tomcat) branch 9.0.x updated: Add best efforts protection for a mis-configured Valve markt
2026/08/28 (tomcat) branch 10.1.x updated: Add best efforts protection for a mis-configured Valve markt
2026/08/28 (tomcat) branch 11.0.x updated: Add best efforts protection for a mis-configured Valve markt
2026/08/28 (tomcat) branch main updated: Add best efforts protection for a mis-configured Valve markt
2026/08/27 (tomcat) branch 9.0.x updated: Fix IDE warning markt
2026/08/27 (tomcat) branch 10.1.x updated: Fix IDE warning markt
2026/08/27 (tomcat) branch 11.0.x updated: Fix IDE warning markt
2026/08/27 (tomcat) branch main updated: Fix IDE warning markt
2026/08/27 (tomcat-native) branch main updated: Fix typo markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Make the call to a CertificateVerifier more robust markt
2026/08/27 (tomcat-native) branch main updated: Make the call to a CertficateVerifier more robust markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Avoid a potential crash with very long ALPN protocol names markt
2026/08/27 (tomcat-native) branch main updated: Avoid a potential crash with very long ALPN protocol names markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Fix a potential crash when configuring raw certificates. markt
2026/08/27 (tomcat-native) branch main updated: Fix a potential crash when configuring raw certificates. markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Keep connection and context verification settings separate markt
2026/08/27 (tomcat-native) branch main updated: Keep connection and context verification settings separate markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Add missing UNREFERENCED() handling markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Remove unused parameters markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Remove unused macros markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Remove unused macros markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Remove unused code markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Remove unused code markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Fix copy/paste error markt
2026/08/27 (tomcat-native) branch 1.3.x updated: Remove unused JNI exports markt
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 (tomcat-native) 01/06: Remove unused code markt
2026/08/27 (tomcat-native) 02/06: Remove unused code markt
2026/08/27 (tomcat-native) branch 1.3.x updated (77a879910 -> 093f672dc) markt
2026/08/27 (tomcat-native) 05/06: Remove unused code markt
2026/08/27 (tomcat-native) 06/06: Remove unused code markt
2026/08/27 (tomcat-native) 03/06: Remove unused code markt
2026/08/27 (tomcat-native) 04/06: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove more unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove remaining unused types markt
2026/08/27 (tomcat-native) branch main updated: Remove remaining unused structure members markt
2026/08/27 (tomcat-native) branch main updated: Remove remaining unused declarations markt
2026/08/27 (tomcat-native) branch main updated: Remove remaining unused functions markt
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 (tomcat) branch main updated: Remove deprecated code markt
2026/08/27 (tomcat) branch 9.0.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch 10.1.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch 11.0.x updated: Deprecate unused code markt
2026/08/27 (tomcat) 02/02: Deprecate unused code markt
2026/08/27 (tomcat) branch main updated (d3c07eec82 -> 91f7934cf3) markt
2026/08/27 (tomcat) 01/02: Remove deprecated code markt
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 Re: [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 [PR] Allow Request#getDateHeader to parse dates in RFC 9651 Structured Field Values format [tomcat] via GitHub
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat) branch 9.0.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch 11.0.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch 10.1.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch main updated: Deprecate unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat) branch main updated: Remove deprecated code markt
2026/08/27 (tomcat) branch 9.0.x updated: Deprecate unused code and update deprecation info markt
2026/08/27 (tomcat) branch 10.1.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch 11.0.x updated: Deprecate unused code markt
2026/08/27 (tomcat) branch main updated: Deprecate unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove unused code markt
2026/08/27 (tomcat-native) branch main updated: Remove dead code markt
2026/08/26 (tomcat) branch 11.0.x updated: Resolve missing back references or variables as empty string remm
2026/08/26 (tomcat) branch 10.1.x updated: Resolve missing back references or variables as empty string remm
2026/08/26 (tomcat) branch 9.0.x updated: Resolve missing back references or variables as empty string remm
2026/08/26 (tomcat) branch main updated: Resolve missing back references or variables as empty string remm
2026/08/26 (tomcat-native) branch 1.3.x updated: Add support for the extended range of options in OpenSSL 3.x onwards markt
2026/08/26 (tomcat-native) branch main updated: Add support for the extended range of options in OpenSSL 3.x onwards markt
2026/08/26 (tomcat-native) branch 1.3.x updated: Fix a potential crash when negotiating ALPN markt
2026/08/26 (tomcat-native) branch 1.3.x updated: Fallback as intended if ALPN negotiation fails. markt
2026/08/26 (tomcat-native) branch main updated (10c98b699 -> 035249cc4) markt
2026/08/26 (tomcat-native) 01/02: Fix a potential crash when negotiating ALPN markt
2026/08/26 (tomcat-native) 02/02: Fallback as intended if ALPN negotiation fails. markt
2026/08/26 Re: (tomcat) branch 9.0.x updated: Try again. Coty Sutherland
2026/08/26 (tomcat) branch 9.0.x updated: Improve robustness of o.a.c.core package to system clock jumps markt
2026/08/26 (tomcat) branch 10.1.x updated: Improve robustness of o.a.c.core package to system clock jumps markt
2026/08/26 (tomcat) branch 11.0.x updated: Improve robustness of o.a.c.core package to system clock jumps markt
2026/08/26 (tomcat) branch main updated: Improve robustness of o.a.c.core package to system clock jumps markt
2026/08/26 (tomcat) branch 9.0.x updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
2026/08/26 (tomcat) branch 10.1.x updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
2026/08/26 (tomcat) branch 11.0.x updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
2026/08/26 (tomcat) branch main updated: Ensure namespace attributes are XML escaped in WebDAV responses markt
2026/08/25 (tomcat) branch 9.0.x updated: Improve handling of get[Pooled]Connection(String,String) markt
2026/08/25 (tomcat) branch 10.1.x updated: Improve handling of get[Pooled]Connection(String,String) markt
2026/08/25 (tomcat) branch 11.0.x updated: Improve handling of get[Pooled]Connection(String,String) markt
2026/08/25 (tomcat) branch main updated: Improve handling of get[Pooled]Connection(String,String) markt
2026/08/25 Buildbot success in on tomcat-9.0.x buildbot
2026/08/25 (tomcat) branch 9.0.x updated: Try again. markt
2026/08/25 (tomcat) branch 9.0.x updated: Fix back-port markt
2026/08/25 Ticketing systems and release/security announcements Mark Thomas
2026/08/25 Buildbot failure in on tomcat-9.0.x buildbot
2026/08/25 [SECURITY] CVE-2026-73180 Apache Tomcat - Authenticated WebSocket session survives end of HTTP session Mark Thomas
2026/08/25 [SECURITY] CVE-2026-68763 Apache Tomcat - DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset Mark Thomas
2026/08/25 [SECURITY] CVE-2026-68569 Apache Tomcat - Principal lookup can fail open in some cases Mark Thomas
2026/08/25 [SECURITY] CVE-2026-65927 Apache Tomcat - RewriteValve [N] restarts at the second rule and may bypass access control Mark Thomas
2026/08/25 [SECURITY] CVE-2026-68525 Apache Tomcat - Redirect after FORM authentication may bypass method specific constraints Mark Thomas
2026/08/25 [SECURITY] CVE-2026-66422 Apache Tomcat - Servlet role references can bypass declarative role constraints Mark Thomas
2026/08/25 [SECURITY] CVE-2026-65905 Apache Tomcat - Limited replay attack possible with DIGEST authentication Mark Thomas
2026/08/25 [SECURITY] CVE-2026-65637 Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation Mark Thomas
2026/08/25 [SECURITY] CVE-2026-65183 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets Mark Thomas
2026/08/25 [SECURITY] CVE-2026-65182 Apache Tomcat - Security constraint bypass Mark Thomas
2026/08/25 svn commit: r1937457 - in tomcat/site/trunk: docs xdocs markt
2026/08/25 Buildbot retry in on tomcat-11.0.x buildbot
2026/08/25 Re: [PR] Skip OCSP tests when responder port is unavailable instead of fail [tomcat] via GitHub
2026/08/25 (tomcat) branch 11.0.x updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
2026/08/25 (tomcat) branch 9.0.x updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
2026/08/25 (tomcat) branch 10.1.x updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
2026/08/25 (tomcat) branch main updated: Skip tribes membership tests when IP multicast is unavailable (#1052) csutherl
2026/08/25 Re: [PR] Skip tribes membership tests when IP multicast is unavailable rather than fail [tomcat] via GitHub
2026/08/25 (tomcat) branch 11.0.x updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
2026/08/25 (tomcat) branch 9.0.x updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
2026/08/25 (tomcat) branch 10.1.x updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
2026/08/25 (tomcat) branch main updated: Skip OCSP tests when responder port is unavailable instead of fail (#1051) csutherl
2026/08/25 Re: [PR] Skip tribes membership tests when IP multicast is unavailable rather than fail [tomcat] via GitHub
2026/08/25 svn commit: r1937432 - in tomcat/site/trunk: docs xdocs markt
2026/08/25 (tomcat) branch 10.1.x updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
2026/08/25 (tomcat) branch 9.0.x updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
2026/08/25 (tomcat) branch 11.0.x updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
2026/08/25 (tomcat) branch main updated: Hardening: Use SecureRandom to generate Sec-WebSocket-Key markt
2026/08/24 Re: [PR] Upgrade actions/setup-java to v6 [tomcat] via GitHub
2026/08/24 Re: [PR] Upgrade actions/setup-java to v6 [tomcat] via GitHub
2026/08/24 [PR] Upgrade actions/setup-java to v6 [tomcat] via GitHub
2026/08/24 [PR] Skip tribes membership tests when IP multicast is unavailable rather than fail [tomcat] via GitHub
2026/08/24 Re: [PR] Skip OCSP tests when responder port is unavailable instead of fail [tomcat] via GitHub
2026/08/24 [PR] Skip OCSP tests when responder port is unavailable instead of fail [tomcat] via GitHub
2026/08/24 Buildbot success in on tomcat-9.0.x buildbot
2026/08/24 (tomcat) branch 9.0.x updated: Fix back-port markt
2026/08/24 Buildbot failure in on tomcat-9.0.x buildbot
2026/08/24 Buildbot success in on tomcat-12.0.x buildbot
2026/08/24 (tomcat) branch 9.0.x updated: Prevent session swap out if associated with currently active request markt
2026/08/24 (tomcat) branch 10.1.x updated: Prevent session swap out if associated with currently active request markt
2026/08/24 (tomcat) branch 11.0.x updated: Prevent session swap out if associated with currently active request markt
2026/08/24 (tomcat) branch main updated: Prevent session swap out if associated with currently active request markt
2026/08/24 (tomcat) branch main updated: Fix broken test markt
2026/08/21 [PR] Fix drawboard rendering for axis-aligned shapes [tomcat] via GitHub
2026/08/21 Buildbot failure in on tomcat-12.0.x buildbot
2026/08/21 Buildbot success in on tomcat-10.1.x buildbot

Earlier messages