THALES GROUP LIMITED DISTRIBUTION to email recipients Hello,
Thanks a lot for your effort on this project 😊 Can't wait for TomEE 10.3.0 delivery ... Best Regards. -----Original Message----- From: Markus Jung via users <[email protected]> Sent: mardi 3 novembre 2026 20:27 To: [email protected] Cc: Markus Jung <[email protected]> Subject: Re: TomEE and CVE-2026-65637 I hope to be able to run a release as soon as tomorrow for both 11.0.0-M2 and 10.3.0 if everything works now. Sorry for the long time without a releases, we had quite a lot of blockers we needed clear first. We’re all operating on very limited time budgets afterall. Thanks Markus > On 3. Nov 2026, at 18:59, Richard Zowalla via users <[email protected]> > wrote: > > No worries, I expect a release soon. AFAIR we are in the last stabilizing > work since we updated a bunch of dependencies and fixed a lot of stuff. > I would even say, that you need a fixed seat for what is coming ;-) > > Regarding release: We have instructions here > https://tomee.apache.org/dev/release-tomee.html > > Gruß > Richard > >> Am 03.11.2026 um 18:55 schrieb Jonathan S. Fisher <[email protected]>: >> >> Man for the life of me I can't remember how to run the release. I >> probably need a senior committer to walk me through it again. >> Francois in the mean time you could update and run the build locally >> without tests and try it against your own application! >> >> On Tue, Nov 3, 2026 at 1:35 AM COURTAULT Francois via users < >> [email protected]> wrote: >> >>> THALES GROUP LIMITED DISTRIBUTION to email recipients >>> >>> Hello everyone, >>> >>> This CVE affected TomEE 10.2.0 (latest available version). It is >>> brought by tomcat-coyote component in Tomcat 10.1.57. >>> The CVE is fixed in Tomcat 10.1.59. >>> BTW latest Tomcat version is 10.1.61 . >>> >>> Do you plan to release a new TomEE 10.x version with updated >>> components soon ? >>> >>> Best Regards. >>> >>> >> >> -- >> Jonathan | [email protected] >> Pessimists, see a jar as half empty. Optimists, in contrast, see it >> as half full. >> Engineers, of course, understand the glass is twice as big as it >> needs to be. >
