dev  

Messages by Date

• 2026/09/24 [Bug 70248] New: Uploads fail over HTTP/2: Tomcat closes the connection with "payload is [16777215] bytes long but the maximum frame size is [16384]" bugzilla
• 2026/09/24 (tomcat) 02/03: Complete securePort support for DNS membership (untested) markt
• 2026/09/24 TLS support for tribes (clustering) Mark Thomas
• 2026/09/24 (tomcat) 01/03: Align naming markt
• 2026/09/24 (tomcat) 03/03: Update docs to recommend TLS rather than EncryptInterceptor markt
• 2026/09/24 (tomcat) branch main updated (85d7b3a067 -> bb4e829af0) markt
• 2026/09/24 (tomcat) branch main updated (a0c3ab5657 -> 85d7b3a067) markt
• 2026/09/24 (tomcat) 02/02: Fix various edge cases for secure only configurations markt
• 2026/09/24 (tomcat) 01/02: Better logging for secure vs non-secure cluster configuration markt
• 2026/09/23 (tomcat-maven-plugin) branch dependabot/maven/org.apache-apache-40 deleted (was f11a94b) github-bot
• 2026/09/23 (tomcat-maven-plugin) 01/01: Merge pull request #139 from apache/dependabot/maven/org.apache-apache-40 remm
• 2026/09/23 (tomcat-maven-plugin) branch trunk updated (9799978 -> e6b55d1) remm
• 2026/09/23 Re: [PR] Bump org.apache:apache from 38 to 40 [tomcat-maven-plugin] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6 deleted (was 9e5c162) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.6.0 markt
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.6.0 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6 updated (d57b77a -> 9e5c162) github-bot
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 [tomcat-tck] via GitHub
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 [tomcat-tck] via GitHub
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.jboss.arquillian.container-arquillian-tomcat-embedded-10-1.2.5.Final deleted (was a16b248) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.jboss.arquillian.container:arquillian-tomcat-embedded-10 markt
• 2026/09/23 Re: [PR] Bump org.jboss.arquillian.container:arquillian-tomcat-embedded-10 from 1.2.4.Final to 1.2.5.Final [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.jboss.arquillian.container-arquillian-tomcat-embedded-10-1.2.5.Final updated (891ce31 -> a16b248) github-bot
• 2026/09/23 Re: [PR] Bump org.jboss.arquillian.container:arquillian-tomcat-embedded-10 from 1.2.4.Final to 1.2.5.Final [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6 updated (9633c66 -> d57b77a) markt
• 2026/09/23 Re: [PR] Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.jacoco-jacoco-maven-plugin-0.8.15 deleted (was c244d94) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 markt
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.junit:junit-bom from 6.0.3 to 6.1.0 markt
• 2026/09/23 Re: [PR] Bump org.junit:junit-bom from 6.0.3 to 6.1.0 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.junit-junit-bom-6.1.0 deleted (was 6712131) github-bot
• 2026/09/23 Re: [PR] Bump arquillian.version from 1.10.1.Final to 1.10.2.Final [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/arquillian.version-1.10.2.Final deleted (was 0752955) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump arquillian.version from 1.10.1.Final to 1.10.2.Final markt
• 2026/09/23 Re: Coverity Issues Review Fatima Qaisar
• 2026/09/23 [SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas
• 2026/09/23 (tomcat-native) branch 1.3.x updated: Stop OCSP checks once a cert in the trust store is reached markt
• 2026/09/23 (tomcat-native) branch main updated: Stop OCSP checks once a cert in the trust store is reached markt
• 2026/09/23 [SECURITY] CVE-2026-86247 Apache Tomcat Native - Client certificate requirements can be down-graded Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86246 Apache Tomcat Native - Insecure OpenSSL options enabled Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86243 Apache Tomcat Native - DoS via TLS handshake Mark Thomas
• 2026/09/23 svn commit: r1938458 - in tomcat/site/trunk: docs xdocs markt
• 2026/09/23 [SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
• 2026/09/23 svn commit: r1938456 - in tomcat/site/trunk: docs xdocs markt
• 2026/09/23 Re: (tomcat) 01/02: Implement TSL-PSK encryption for clustering Rémy Maucherat
• 2026/09/22 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/22 (tomcat) branch 9.0.x updated: Fix IDE warning markt
• 2026/09/22 (tomcat) branch 10.1.x updated: Fix IDE warning markt
• 2026/09/22 (tomcat) branch 11.0.x updated: Fix IDE warning markt
• 2026/09/22 Re: [PR] Enforce write interest registration state [tomcat] via GitHub
• 2026/09/22 (tomcat) branch main updated: Suppress IDE warning markt
• 2026/09/22 Re: Coverity Issues Review Mark Thomas
• 2026/09/22 Re: (tomcat) 01/02: Implement TSL-PSK encryption for clustering Mark Thomas
• 2026/09/22 (tomcat) 02/02: Clarify the exclusion markt
• 2026/09/22 (tomcat) 01/02: Implement TSL-PSK encryption for clustering markt
• 2026/09/22 (tomcat) branch main updated (590267e7ef -> 23f25ee5c3) markt
• 2026/09/22 Re: [PR] Bump org.apache:apache from 38 to 39 [tomcat-maven-plugin] via GitHub
• 2026/09/22 (tomcat-maven-plugin) branch dependabot/maven/org.apache-apache-40 created (now f11a94b) github-bot
• 2026/09/22 (tomcat-maven-plugin) branch dependabot/maven/org.apache-apache-39 deleted (was ffa6f99) github-bot
• 2026/09/22 [PR] Bump org.apache:apache from 38 to 40 [tomcat-maven-plugin] via GitHub
• 2026/09/22 Re: [PR] Bump org.apache:apache from 38 to 39 [tomcat-maven-plugin] via GitHub
• 2026/09/22 Re: Coverity Issues Review Fatima Qaisar
• 2026/09/22 Buildbot success in on tomcat-12.0.x buildbot
• 2026/09/22 Buildbot success in on tomcat-9.0.x buildbot
• 2026/09/22 (tomcat-native) 02/02: Add client-side PSK support for TLSv1.2 markt
• 2026/09/22 (tomcat-native) 01/02: Move to correct section markt
• 2026/09/22 (tomcat-native) branch main updated (84c6f655d -> b7c6d465a) markt
• 2026/09/22 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/22 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/22 (tomcat) branch main updated: Improve test and add no arg constructor remm
• 2026/09/22 Buildbot failure in on tomcat-12.0.x buildbot
• 2026/09/22 (tomcat) branch 9.0.x updated: Add missing @Override markt
• 2026/09/22 (tomcat) branch 10.1.x updated: Add missing @Override markt
• 2026/09/22 (tomcat) branch 11.0.x updated: Add missing @Override markt
• 2026/09/22 (tomcat) branch main updated: Add missing @Override markt
• 2026/09/22 (tomcat) 02/02: Expand the PSK support to cover OpenSSL-FFM markt
• 2026/09/22 (tomcat) 01/02: Add support for pre-shared keys with Tomcat Native TLS connections. markt
• 2026/09/22 (tomcat) branch main updated (337d9f0171 -> 2ad4b3d7ef) markt
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Mark Thomas
• 2026/09/22 Re: Potential changes to OpenSSL[-FFM] OCSP validation Rémy Maucherat
• 2026/09/22 Buildbot success in on tomcat-10.1.x buildbot
• 2026/09/22 [Bug 70247] New: HTTP/2: unread request body is never returned to the connection flow control window bugzilla
• 2026/09/22 Potential changes to OpenSSL[-FFM] OCSP validation Mark Thomas
• 2026/09/22 Buildbot success in on tomcat-11.0.x buildbot
• 2026/09/22 Buildbot success in on tomcat-12.0.x buildbot
• 2026/09/22 (tomcat) branch main updated: Allow alternate protocols remm
• 2026/09/22 (tomcat) branch 9.0.x updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 (tomcat) branch 10.1.x updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 (tomcat) branch 11.0.x updated: Remove unwanted change remm
• 2026/09/22 (tomcat) branch main updated: Remove unwanted change remm
• 2026/09/22 Re: (tomcat) branch main updated: Update documentation for the switch to 25 for FFM Mark Thomas
• 2026/09/22 (tomcat) branch 11.0.x updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 (tomcat) branch main updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Rémy Maucherat
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Mark Thomas
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Rémy Maucherat
• 2026/09/22 Re: Buildbot failure in on tomcat-12.0.x Rémy Maucherat
• 2026/09/22 Buildbot failure in on tomcat-10.1.x buildbot
• 2026/09/22 (tomcat) branch 11.0.x updated: Bump Java needed to build to 25 remm
• 2026/09/22 Buildbot failure in on tomcat-11.0.x buildbot
• 2026/09/22 (tomcat) branch 9.0.x updated: Bump Java needed to build to 25 remm
• 2026/09/22 (tomcat) branch 10.1.x updated: Bump Java needed to build to 25 remm
• 2026/09/22 Buildbot failure in on tomcat-12.0.x buildbot
• 2026/09/22 (tomcat) branch main updated: Bump Java needed to build to 25 remm
• 2026/09/21 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/21 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/21 [Bug 70245] New: Documentation update required for Tomcat Native configuration guide bugzilla
• 2026/09/21 Re: (tomcat) 02/02: Align with recent Native changes to add PSK support Mark Thomas
• 2026/09/21 (tomcat) 02/02: Align with recent Native changes to add PSK support markt
• 2026/09/21 (tomcat) 01/02: Mirror changes in Native for PSK support with TLS 1.2 markt
• 2026/09/21 [Bug 70244] New: i have encouter an error on my webiste while using date and time function bugzilla
• 2026/09/21 (tomcat) branch main updated (9e9d3a89b3 -> 44087b688a) markt
• 2026/09/21 (tomcat-native) 01/03: Add PSK support for TLS 1.2 markt
• 2026/09/21 (tomcat-native) 02/03: Add PSK support for TLS 1.3 markt
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 (tomcat-native) 03/03: Expand the Javadoc a little. markt
• 2026/09/21 (tomcat-native) branch main updated (761680113 -> 84c6f655d) markt
• 2026/09/21 [Bug 70236] TLS handshake stalls when the server's first flight is bigger than the BIO pair buffer bugzilla
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 [Bug 70245] SPAM SPAM SPAM SPAM bugzilla
• 2026/09/21 [Bug 70244] SPAM SPAM SPAM SPAM bugzilla
• 2026/09/21 Re: [Bug 70245] New: Documentation update required for Tomcat Native configuration guide Mark Thomas
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 [Bug 70241] EL method invocation calls Class.getMethods() on every evaluation; resolved methods are not cached, unlike bean properties bugzilla
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 (tomcat) branch 9.0.x updated: Fix edge case with long certificate chain remm
• 2026/09/21 (tomcat) branch 10.1.x updated: Fix edge case with long certificate chain remm
• 2026/09/21 (tomcat) branch 11.0.x updated: Fix edge case with long certificate chain remm
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 (tomcat) branch main updated: Fix edge case with long certificate chain remm
• 2026/09/21 Buildbot success in on tomcat-9.0.x buildbot
• 2026/09/21 [Bug 70245] Documentation update required for Tomcat Native configuration guide bugzilla
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 Re: [PR] Enforce write interest registration state [tomcat] via GitHub
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/21 (tomcat) branch 10.1.x updated: KeepAliveCount is a default attribute remm
• 2026/09/20 (tomcat) branch 9.0.x updated: KeepAliveCount is a default attribute remm
• 2026/09/20 (tomcat) branch 11.0.x updated: KeepAliveCount is a default attribute remm
• 2026/09/20 (tomcat) branch main updated: KeepAliveCount is a default attribute remm
• 2026/09/20 [PR] Bump codecov/codecov-action from 7.0.0 to 7.1.1 [tomcat-jakartaee-migration] via GitHub
• 2026/09/20 (tomcat-jakartaee-migration) branch dependabot/github_actions/codecov/codecov-action-7.1.1 created (now 929d980) github-bot
• 2026/09/20 [Bug 70241] EL method invocation calls Class.getMethods() on every evaluation; resolved methods are not cached, unlike bean properties bugzilla
• 2026/09/20 Re: [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/20 [Bug 70241] New: EL method invocation calls Class.getMethods() on every evaluation; resolved methods are not cached, unlike bean properties bugzilla
• 2026/09/19 Re: [PR] Document Tribes status monitoring [tomcat] via GitHub
• 2026/09/19 Re: [PR] Load OCSP test status from certificate database [tomcat] via GitHub
• 2026/09/19 Re: [PR] Enforce write interest registration state [tomcat] via GitHub
• 2026/09/19 [PR] Enforce write interest registration state [tomcat] via GitHub
• 2026/09/19 Re: [PR] Document Tribes status monitoring [tomcat] via GitHub
• 2026/09/19 [PR] Document Tribes status monitoring [tomcat] via GitHub
• 2026/09/18 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/18 Re: [PR] Add opt-in ServerInfo.properties override support [tomcat] Coty Sutherland
• 2026/09/18 Re: [PR] Add opt-in ServerInfo.properties override support [tomcat] via GitHub
• 2026/09/18 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/18 (tomcat) branch main updated: No need for volatile here. markt
• 2026/09/18 (tomcat) branch 10.1.x updated: No need for volatile here. markt
• 2026/09/18 (tomcat) branch 9.0.x updated: No need for volatile here. markt
• 2026/09/18 (tomcat) branch 11.0.x updated: No need for volatile here. markt
• 2026/09/18 [Bug 70236] New: TLS handshake stalls when the server's first flight is bigger than the BIO pair buffer bugzilla
• 2026/09/18 [Bug 70236] TLS handshake stalls when the server's first flight is bigger than the BIO pair buffer bugzilla
• 2026/09/18 [PR] Fix stalled TLS handshake when the server's first flight is too large [tomcat] via GitHub
• 2026/09/18 [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/17 (tomcat) branch 10.1.x updated: Align load() error handling with server.start() error handling markt
• 2026/09/17 (tomcat) branch 9.0.x updated: Performance: Check for EOF before the numeric test in readHostIPv4 markt
• 2026/09/17 (tomcat) branch 10.1.x updated: Performance: Check for EOF before the numeric test in readHostIPv4 markt
• 2026/09/17 (tomcat) branch 11.0.x updated: Performance: Check for EOF before the numeric test in readHostIPv4 markt
• 2026/09/17 (tomcat) branch main updated: Performance: Check for EOF before the numeric test in readHostIPv4 markt
• 2026/09/17 Re: [PR] [perf] Check for EOF before the numeric test in readHostIPv4 [tomcat] via GitHub
• 2026/09/17 (tomcat) branch 9.0.x updated: Align load() error handling with server.start() error handling markt
• 2026/09/17 (tomcat) branch 11.0.x updated: Align load() error handling with server.start() error handling markt
• 2026/09/17 (tomcat) branch 9.0.x updated: Avoid start then immediate stop when an error occurs with await enabled markt
• 2026/09/17 (tomcat) branch 11.0.x updated: Avoid start then immediate stop when an error occurs with await enabled markt
• 2026/09/17 (tomcat) branch 10.1.x updated: Avoid start then immediate stop when an error occurs with await enabled markt
• 2026/09/17 [PR] [perf] Check for EOF before the numeric test in readHostIPv4 [tomcat] via GitHub
• 2026/09/17 (tomcat) branch main updated (14901ae4cc -> fc7fd5deb2) markt
• 2026/09/17 (tomcat) 02/02: Align load() error handling with server.start() error handling markt
• 2026/09/17 (tomcat) 01/02: Avoid start then immediate stop when an error occurs with await enabled markt
• 2026/09/17 (tomcat) branch 11.0.x updated: Avoid saving some Context to server.xml remm
• 2026/09/17 (tomcat) branch 9.0.x updated (b0fc9a461f -> 811f663e1f) remm
• 2026/09/17 (tomcat) 01/02: Avoid saving some Context to server.xml remm
• 2026/09/17 (tomcat) 02/02: Fix Java compat remm
• 2026/09/17 (tomcat) branch 10.1.x updated (e48ffad1db -> 75bdfd2e6a) remm
• 2026/09/17 (tomcat) 02/02: Fix Java compat remm
• 2026/09/17 (tomcat) 01/02: Avoid saving some Context to server.xml remm

• Earlier messages