| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: tomcat11-lib | Distribution: openSUSE Tumbleweed |
| Version: 11.0.24 | Vendor: openSUSE |
| Release: 1.1 | Build date: Tue Jul 28 09:55:02 2026 |
| Group: Productivity/Networking/Web/Servers | Build host: reproducible |
| Size: 7065065 | Source RPM: tomcat11-11.0.24-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://tomcat.apache.org | |
| Summary: Libraries needed to run the Tomcat Web container | |
Libraries required to successfully run the Tomcat Web container
Apache-2.0
* Thu Jul 23 2026 mbussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.24
* adapt tomcat-jdt.patch
* Fixed CVEs:
+ CVE-2026-59084: The requirements to secuely configure the
EncryptInterceptor were not clearly documented. (bsc#1271398)
+ CVE-2026-59083: Incorrect decoding of + in rewritten URIs to a single
space could allow security control bypass for some configurations.
(bsc#1271397)
* Catalina
+ Fix: Avoid a race condition with concurrent lookups for a singleton JNDI
resource. (markt)
+ Fix: Improve the performance of range validation for the default
servlet. (markt)
+ Fix: Avoid NPE in RewriteValve. (markt)
+ Fix: 70127: Fix use of Bootstrap through reflection by restoring the
public constructor. Use through scripts was not affected. (remm)
+ Fix: Restore ability to extend many element classes from
AbstractAccessLogValve. (remm)
+ Fix: Align DIGEST authentication with RFC 7616 and require clients to
provide a valid qop parameter. (markt)
+ Fix: Use Files API to create temporary docBase when antiLockingDocBase
is enabled. (markt)
+ Fix: Improve validation of configuration when DataSourceRealm starts.
(remm)
+ Fix: JAASRealm should do a logout if login does not fail outright but
does not produce a Principal. (remm)
+ Fix: Various edge cases for SSI substitutions, quoting and escaping.
(remm)
+ Fix: unintentional conversion of literal + to a space during rule
processing in the RewriteValve. (markt)
* Coyote
+ Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native
is not available when the connector is explicitly configured to use
Tomcat Native with OpenSSL for TLS. (markt)
* Jasper
+ Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix
for 69333) was incomplete and tags that threw exceptions in doStartTag()
and doEndTag() were incorrectly re-used. This fix prevents tags from
being re-used if such an exception occurs. (markt)
+ Add: support for specifying Java 28 (with the value 28) as the compiler
source and/or compiler target for JSP compilation. If used with an
Eclipse JDT compiler version that does not support these values, a
warning will be logged and the default will be used. (markt)
* WebSocket
+ Fix: 70126: Fix WebSocket extension permessage-deflate so that it does
not drop bytes if a compressed message inflates to more than the
available buffer. Fix written by GPT-5.5. Test case written by Hironori
Ichimiya. (markt)
+ Fix: Optimise WebSocket client processing of server responses during
WebSocket HTTP upgrade process. (markt)
* Other
+ Update: to the Eclipse JDT compiler 4.40. (markt)
+ Update: Byte Buddy to 1.18.9. (markt)
+ Update: UnboundID to 7.0.5. (markt)
+ Update: JaCoCo to 0.8.15. (markt)
+ Update: BND to 7.3.0. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
* Fri Jul 03 2026 Ricardo Mestre <ricardo.mestre@suse.com>
- Upgrade libtcnative to v2 (bsc#1232390)
* Wed Jul 01 2026 Ricardo Mestre <ricardo.mestre@suse.com>
- Update to Tomcat 11.0.23
* Fixed CVEs:
+ CVE-2026-55956: Security constraints for default servlet ignored method
(bsc#1269907)
+ CVE-2026-55955: EncryptInterceptor not protected against replay attacks
(bsc#1269908)
+ CVE-2026-55276: Logged effective web.xml is incomplete (bsc#1269909)
+ CVE-2026-53434: Invalid CRL configuration doesn't trigger failure for FFM
Connector (bsc#1269824)
+ CVE-2026-53404: Bad ornext processing in RewriteValve (bsc#1269910)
+ CVE-2026-50229: XSS in number guess example (bsc#1269791)
* Catalina
+ Add: Add support for literal '%' characters in access log output. Based on
pull request #1002 by Fabian Hahn. (markt)
+ Fix: Lower the log level to debug when OpenSSL initialization fails in
OpenSSLLifecycleListener to avoid stack traces when libssl.so is not
present and to align the behavior of the isAvailable() check with the
AprLifecycleListener and gracefully fail when natives are not present.
(csutherl)
+ Fix: 70038: Cookie.clone() should also clone the internal attribute map.
(markt)
+ Code: Remove unnecessary code from the SSI processing engine that was
duplicating some of the normalisation checks. (markt)
+ Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
+ Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
(remm)
+ Fix: Incorrect session average life calculation. (remm)
+ Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
(remm)
+ Fix: Avoid any init parameter updates when conflicts are found for
filters, similar to what is done for servlets, as required by the servlet
specification. (remm)
+ Fix: Fix container event cleanups in some edge cases. (remm)
+ Fix: Check for last-modified header in ExpiresFilter when a servlet uses
addDateHeader to avoid wrongly considering it has been set. (remm)
+ Fix: Fix hour unit used by ExpiresFilter. (remm)
+ Fix: Remove exception swallowing in DataSourceStore to align it with
FileStore and avoid session loss on errors. (remm)
+ Fix: Add support for single-quote escaped literal as well as quoted
literals in DateFormatCache. (schultz)
+ Fix: On JAAS logout, clear out role principals on the subject that were
added on commit, as recommended by the JAAS specification. (remm)
+ Fix: MemoryRealm should not add a dummy role when none is specified in the
configuration. (remm)
+ Fix: DataSourceUserDatabase should return a null principal on a non
existing user. (remm)
+ Fix: Fix shared lock expiration in WebDAV. (remm)
+ Fix: Inaccurate session exipration statistics when using the persistent
manager. (remm)
+ Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
+ Fix: Mixup of WrapperListener and WrapperLifecycle elements in
storeconfig. (remm)
+ Fix: Incorrect processing of modified users in DataSourceUserDatabase.
(remm)
+ Update: Clarify behavior in the UserDatabase for user, role and group
creation that it does not immediately override existing elements. Removal
(or update) needs to be used instead. (remm)
+ Fix: 70049: Align the web application class loader with parent class
loaders and swallow any errors caused by invalid paths when looking up
resources and behave as if the resources were not found in that case.
(markt)
+ Fix: Improve validation of Range and Content-Range parsers so invalid
ranges trigger a 4xx response rather than a 500 response. Pull request
[#1012] provided by Sahana Surendra Bogar. (markt)
+ Fix: Fix connection leak in ProxyErrorReportValve. (remm)
+ Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off
rather than true or false to align with httpd. (markt)
+ Fix: Reset the encoding used for query string parameters between requests
in case an application changed the encoding in a previous request. (markt)
+ Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce
to URLs that are known not to require it. (markt)
+ Fix: Fix SSO cookie partitioned configuration. (remm)
+ Fix: Fix CombinedRealm isAvailable, it allows authentication if at least
one sub realm is available. (remm)
+ Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
(markt)
+ Fix: Improve the detection of cross-context dispatches when using a
RequestDispatcher. (markt)
+ Fix: Fix various instances of double decoding of URL patterns configured
either programmatically or in web.xml. (remm/markt)
+ Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,
which follows a purely sequential evaluation strategy. (remm)
+ Fix: Update default web.xml version to match supported Servlet
specification version. (markt)
+ Fix: Change the default for the useRedirect attribute of the
ProxyErrorReportValve from true to false. (markt)
+ Add: Add support for the showReport attribute in JsonErrorReportValve and
ProxyErrorReportValve. When set to false, detailed error information
(message, description, stack trace) is suppressed from error responses.
(dsoumis)
+ Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is
removed but catalina-ha.jar is present and the Cluster element is enabled
in server.xml. Cluster digester rules are now fully conditional on both
JARs being available. (dsoumis)
+ Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)
+ Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list
of reserved prefixes for SSI variables and request attributes. (markt)
+ Fix: Missing URL decoding when processing addMapping on a Servlet
registration. (remm)
+ Fix: The Timeout WebDAV header allows comma separated values (according to
the examples in the RFC). Use the first acceptable value. (remm)
+ Fix: Fix various issues when logging the effective web.xml for a web
application. Empty sections are no longer logged. Special roles and empty
authorisation constraints are included. All session cookie attributes are
included. (markt)
+ Fix: Expand the write lock for the save process in the MemoryUserDatabase
to avoid concurrency issues with the file save operations. (markt)
+ Fix: Ensure atomic session persistence in FileStore. Based on pull request
[#1016] by sahvx655-wq. (markt)
+ Fix: Do not ignore methods configured on security constraints that map to
the default servlet. (markt)
* Cluster
+ Fix: Expand wording and increase visibility of log message when cloud
membership is configured without a trust store as all certificates will be
trusted in this configuration. (markt)
+ Fix: Ensure listeners are correctly added and removed when configuring the
channel coordinator. (markt)
+ Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)
+ Fix: Fix some concurrency issues in OrderInterceptor. (markt)
+ Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)
+ Fix: Fix concurrency issues generating MD5 digests in the
CloudMembershipProvider implementations. (markt)
+ Add: Add replay protection to the EncryptInterceptor. This us a breaking
change for the EncryptInterceptor.(markt)
* Coyote
+ Add: Log a suitable warning if an encrypted PEM file is detected using an
insecure form for encryption. (markt)
+ Fix: If TLS groups have been configured, use the configured groups rather
than using OpenSSL's default TLS groups when using Tomcat Native with
OpenSSL based connectors. (markt)
+ Fix: For HTTP/2, ensure that any in progress request body reads are
cancelled if the container resets the associated stream. This prevents
delays waiting for reads to time out when it is known that no more data
will be received. (markt)
+ Fix: Ensure that malformed HTTP/2 messages that should trigger a stream
reset do so, rather than triggered a connection close. (markt)
+ Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)
+ Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,
following refactor clean-up of header buffer. (remm)
+ Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)
+ Fix: Fix MessageByte.equals if called on a null MB. (remm)
+ Fix: Call the delegate key manager in JSSE to retrieve the server key.
(remm)
+ Fix: Avoid overflow scenarios in Asn1Parser. (remm)
+ Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that
allows the consistency check for the scheme provided by the user agent to
be bypassed. (markt)
+ Fix: isTrailerFieldsReady was always returning true. (remm)
+ Fix: Align OpenSSL/Panama TLS implementation with other implementations
and throw an exception if there is an error loading the provided CRL(s).
(markt)
+ Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if
@STRENGTH was encountered, ignoring any subsequent expressions. (markt)
+ Fix: Handle the case where the HTTP/2 payload length is insufficient for
the mandatory data required by the flags set in the header. (markt)
+ Fix: 70102: Correct expected size of ticket keys when calling
setSessionTicketKeys with an FFM connector. (markt)
+ Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken
by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)
+ Fix: When processing an OpenSSL cipher specification, fully align the
order of the resulting ciphers with the order produced by OpenSSL. (markt)
+ Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
(schultz)
+ Update: Update both the minimum and recommended version for Tomcat Native
2.x to 2.0.15. (markt)
+ Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
* Jasper
+ Fix: Fix possible EL argument mismatch when it was set to null. (remm)
+ Fix: Fix thread safety of TagPluginManager. (remm)
+ Fix: Correctly use flush on JSP include. (remm)
* Web applications
+ Add: Manager: Add checks to ensure that any uploaded files are uploaded to
the expected location. (markt)
+ Add: Manager: Add checks to ensure that the requested context path for a
deployed WAR, directory or descriptor file is valid. (markt)
+ Add: Documentation: Expand the description of some of the attributes of
the CrawlerSessionManagerValve. (markt)
+ Fix: Documentation: Clearer description and correct documented default for
ocspSoftFail. (markt)
+ Fix: Fix double escaping in the context names for the JSON mode of the
manager servlet. (remm)
+ Fix: Manager: Ensure automatic deployment does not trigger an undeployment
during a Manager triggered web application reload. (markt)
+ Fix: Documentation: Provide better documentation for the scheme and secure
attributes of a Connector. (markt)
* Websocket
+ Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)
+ Fix: Trigger standard WebSocket error handling if a call to
Endpoint.onOpen() fails for a programmatic endpoint. (markt)
+ Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a
programmatic endpoint. Test case provided by uabdur. (markt)
+ Fix: If a client presents invalid parameters when negotiating a WebSocket
extension, decline the negotiation offer that includes the invalid
parameters rather than failing the connection. Pull request #1019 provided
by sahvx655-wq. (markt)
* Other
+ Fix: Use per connection authenticator when executing an Ant task.
(remm/markt)
+ Update: Update Commons Daemon to 1.6.1. (markt)
+ Fix: Prevent duplicate log messages when clustering JARs are not present
on startup. (csutherl)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.12. (markt)
+ Update: Update Tomcat Native to 2.0.15. (markt)
* Thu May 28 2026 mbussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.22
* Fixed CVEs:
+ CVE-2026-43515: Security constraints not correctly applied (bsc#1265168)
+ CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167)
+ CVE-2026-43513: LockOutRealm treats user names as case-sensitive
(bsc#1265166)
+ CVE-2026-43512: Digest authenticator will authenticate any unknown user
(bsc#1265145)
+ CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165)
+ CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163)
+ CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling
(bsc#1265162)
* Catalina
+ Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and
OpenSSL version information (both APR and FFM implementations), along with
version compatibility warnings and third-party library version
information. (csutherl)
+ Code: Refactor generation of the remote user element in the access log to
remove unnecessary code. (markt)
+ Fix: Fix a regression in the previous release that meant ?- could appear
in the access log rather than ? when the query string was present but
empty. (markt)
+ Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by
Mahmoud Alarby. (remm)
+ Fix: Align the escaping in ExtendedAccessLogValve with the other
AccessLogValve implementations. (markt)
+ Fix: 70000: fix duplication of special headers in the response after
commit, following fix for 69967. (remm)
+ Fix: Correct the handling of URIs mapped to a security constraint that
only specifies the special ** role for all authenticated users. Requests
without authentication were receiving 403 responses rather than 401
responses. (markt)
+ Fix: Fix a race condition in StandardContext.getServletContext() that
could cause the jakarta.servlet.context.tempdir attribute to be lost
during a context reload. Make the context field volatile and use locking
to ensure only one ApplicationContext instance is created. (dsoumis)
+ Fix: Update the Windows authentication (kerberos) documentation to reflect
that both Java and Windows are removing / have removed support for
RC4-HMAC. The guide now uses AES256-SHA1. (markt)
+ Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize
which limits the size of a WebDAV request body for LOCK and PROPFIND. The
default value is 4096 bytes. (markt)
+ Add: Add a new caseSensitive attribute to the LockOutRealm that controls
the manner in which user names are treated when making locking decisions.
The default is false, meaning user names are treated in a case insensitive
manner. (markt)
+ Fix: Correct the handling of invalid users with DIGEST authentication.
(markt)
+ Fix: Ensure RealmBase finds all matching extension based security
constraints. (markt)
* Coyote
+ Fix: Avoid various edge cases if Content-Length is set via
setHeader(String,String) or addHeader(String,String) with an invalid value
by always clearing the previous value whether the new value is valid or
not and ignoring any invalid new value. (markt)
+ Code: Refactor the calculation of the real index in the HPACK dynamic
header table implementation to reduce code duplication. (markt)
+ Fix: Fix various minor issues with some HTTP/2 stream error messages for
HTTP/2. (markt)
+ Fix: Consistently reject URIs containing NULL bytes when normalizing.
(markt)
+ Fix: Fix a few minor memory leaks on error paths reading TLS keys and
certificates when using FFM. (markt)
+ Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC
after a stream reset. (markt)
+ Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields
not permitted in trailers. (markt)
+ Fix: Free private keys after use in FFM based connector configuration.
(markt)
+ Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header
decoding that could result in a valid header triggering an unexpected
connection close. (markt)
+ Fix: Refactor HTTP/2 HPACK encoding so header field names are only
converted to lower case once during the encoding process. (markt)
+ Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend
validation to check for disallowed characters as well as upper case
characters. (markt)
+ Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)
+ Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent
with the use (or not) of TLS. (markt)
+ Fix: Correct the validation of pseudo headers and CONNECT requests to
align Tomcat's behaviour with RFC 9113, section 8.5. (markt)
+ Fix: Fix a potential integer overflow when allocating capacity from a
connection level window update to individual HTTP/2 streams. Based on #996
by Mike Tingey Jr. (markt)
+ Fix: Switch AJP secret comparison to a constant time algorithm. (markt)
* WebSocket
+ Fix: Fix the initial connection to a WebSocket end point where the
connection is made via a proxy that requires DIGEST authentication.
(markt)
* Other
+ Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)
+ Add: Add warning when OpenSSL binary is not found. (csutherl)
+ Add: Add check for Tomcat Native library, and log warning when it's not
found to make it easier to see when it's not used by the suite. (csutherl)
+ Update: Update Byte Buddy to 1.18.8. (markt)
+ Update: Update Bouncy Castle to 1.84. (markt)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
* Mon Apr 13 2026 Ricardo Mestre <ricardo.mestre@suse.com>
- Update to Tomcat 11.0.21
- adapt tomcat-jdt.patch
* Fixed CVEs:
+ CVE-2026-24880: Request smuggling via invalid chunk extension
(bsc#1261850)
+ CVE-2026-25854: Occasionally open redirect (bsc#1261851)
+ CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852)
+ CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is
disabled (bsc#1261853)
+ CVE-2026-29146: EncryptInterceptor vulnerable to padding oracle attack by
default (bsc#1261854)
+ CVE-2026-32990: The fix for CVE-2025-66614 was incomplete
+ CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855)
+ CVE-2026-34486: Fix for CVE-2026-29146 allowed bypass of
EncryptInterceptor (bsc#1261854)
+ CVE-2026-34487: Cloud membership for clustering component exposed the
Kubernetes bearer token (bsc#1261856)
+ CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when
soft-fail is disabled (bsc#1261857)
* Catalina
+ Fix: Add escaping for URI and query string in the access log. (markt)
+ Fix: 69967: Fix inconsistencies related to Content-Length and Content-Type
headers when accessed using the getHeader method and similar. (remm)
+ Fix: 69940: Improve redirect handling in the LoadBalancerDrainingValve.
(schultz)
* Cluster
+ Fix: Reduce log verbosity of the Kubernetes connection attempts and
failure. (remm)
+ Fix: Better error handling for the EncryptInterceptor. (markt)
+ Fix: 69970: Support raw IPv6 in Kubernetes membership provider for the
service host. (remm)
+ Add: Add support for new algorithms provided by JPA providers to the
EncyptInterceptor. (markt)
* Coyote
+ Fix: Fix an HTTP/2 header frame parsing bug that could result in a
connection being closed without a GOAWAY frame if an invalid HEADERS frame
was received. (markt)
+ Fix: 69982: Fix a bug in the non-blocking flushing code for NIO+TLS that
meant that a response may not be fully written until the connection is
closed. Pull request #966 provided by Phil Clay. (markt)
+ Fix: Ensure the HTTP/2 request header read buffer is reset (including
restoration to default size) after a stream reset. (markt)
+ Add: Provide trailer field filtering equivalent to that provided for
non-trailer fields. Control characters (excluding TAB), and characters
with code points above 255 will be replaced with a space. (markt)
+ Fix: Align OpenSSl FFM behaviour with Tomcat Native for various OCSP edge
cases. (markt)
+ Fix: Fix case sensitive handling of the protocol host name. (remm)
+ Add: Add an HTTP configuration setting, noCompressionEncodings, that can
be used to control which content encodings will not be compressed when
compression is enabled. Based on pull request #914 by Long9725. (markt)
+ Fix: Add size limit for OCSP responses. Based on code submitted by Chenjp.
(remm)
+ Fix: To maintain the documented alignment with the OpenSSL development
branch, the use of the aliases SSLv3, EXPORT, EXPORT40, EXPORT56, KRB5,
kFZA, aFZA, eFZA and FZA are no longer supported when setting the ciphers
attribute of an SSLHostConfig element. (markt)
+ Fix: To maintain the documented alignment with the OpenSSL development
branch, add support for the aliases ARIAGCM and CBCwhen setting the
ciphers attribute of an SSLHostConfig element. (markt)
+ Add: 69870: Add a drainTimeout to the HTTP/2 UpgradeProtocol element to
allow configuration of an time between the two final GOAWAY frames sent by
Tomcat when closing am HTTP/2 connection. Pull request #917 provided by
Kai Burjack. (markt)
+ Update: Update the minimum recommended version of Tomcat Native so that
users of 1.3.x are recommended to update to 2.0.x. (markt)
+ Fix: Respect the value for the jdk.tls.namedGroups system property as the
default value for the configured group list on the Connector. (remm)
+ Fix: 69964: Respect the configured cipher order, which was no longer
respected following the addition of TLS 1.3 specific cipher configuration.
TLS 1.3 ciphers will always be first in the list. (remm)
+ Fix: Free the x509 object in the FFM code when getting the peer
certificate if getting the bytes from the certificate somehow fails. Pull
request #951 provided by Chenjp. (remm)
+ Fix: Improve HPACK exception use, making sure HpackException is thrown
instead of unexpected types. (remm)
+ Fix: Update the parser for the HTTP Host header and :authority pseudo
header to convert the port, if any, to an Integer rather than a Long to be
consistent with how port is exposed in the Servlet API. (markt)
+ Add: To aid the migration from the single ciphers configuration attribute
to the use of ciphers and cipherSuites, TLS 1.3 cipher suites listed in
the ciphers attribute will be removed from the ciphers attribute and added
to the end of the cipherSuites attribute. This behaviour will be removed
in Tomcat 12.0.x onwards. (markt)
+ Code: Replace the external OpenSSL based OCSP responder used during unit
tests with a Bouncy Castle based, in-process Java OCSP responder. (markt)
+ Fix: Relax HTTP/2 header validation and respond to invalid requests with a
stream reset or a 400 response as appropriate rather then with a
connection reset. (markt)
+ Fix: Add validation of chunk extensions for chunked transfer encoding.
(markt)
+ Update: Update the recommended version for Tomcat Native 2.x to 2.0.14.
(markt)
+ Fix: Align the FFM handling of OCSP TRY_LATER responses with Tomcat
Native. (remm)
+ Fix: Free CA certificate after calling SSL_CTX_add_client_CA in the FFM
code. Based on code from PR 44 from tomcat-native. (remm)
+ Fix: Free certificate chain if an error occurs, in the FFM code. (remm)
+ Fix: Report handshake issues as SSLException in the FFM code, rather than
IllegalStateException. (remm)
* Jasper
+ Fix: 69948: Avoid ArrayOutOfBoundsException instead of
PropertyNotFoundException when generating a properties not found exception
in AstValue. Based on #950 submitted by Jérôme Besnard. (remm)
+ Add: Add support for specifying Java 27 (with the value 27) as the
compiler source and/or compiler target for JSP compilation. If used with
an Eclipse JDT compiler version that does not support these values, a
warning will be logged and the default will be used. (markt)
* Web applications
+ Add: 69931: Add <label> for fields in the HTML manager application. Patch
provided by yukitidev. (schultz)
* Websocket
+ Fix: 69972: Remove unwanted space in DIGEST authorization header. Patch
submitted by Stefan Kalscheuer in #957. (remm)
* Other
+ Update: Update bnd to 7.2.3. (markt)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Update the internal fork of Apache Commons BCEL to 6.12.0. (markt)
+ Update: Update to the Eclipse JDT compiler 4.39. (markt)
+ Update: Update Tomcat Native to 2.0.14. (markt)
+ Update: Update Objenesis to 3.5. (markt)
+ Update: Update Byte Buddy to 1.18.7. (markt)
+ Update: Update BND to 7.2.1. (markt)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Chinese translations provided by eaststrongox.
(markt)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
* Fri Mar 06 2026 Ricardo Mestre <ricardo.mestre@suse.com>
- Update to Tomcat 11.0.18
- adapt tomcat-jdt.patch
* Fixed CVEs:
+ CVE-2025-66614: client certificate verification bypass due to virtual
host mapping (bsc#1258371)
+ CVE-2026-24733: improper input validation on HTTP/0.9 requests
(bsc#1258385)
+ CVE-2026-24734: certificate revocation bypass due to incomplete OCSP
verification checks (bsc#1258387)
* Catalina
+ Fix: 69932: Fix request end access log pattern regression, which would log
the start time of the request instead. (remm)
+ Fix: 69623: Additional fix for the long standing regression that meant
that calls to ClassLoader.getResource().getContent() failed when made from
within a web application with resource caching enabled if the target
resource was packaged in a JAR file. (markt)
+ Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
+ Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
+ Update: Enable minimum and recommended Tomcat Native versions to be set
separately for Tomcat Native 1.x and 2.x. Update the minimum and
recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum
and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
+ Add: Add a new ssoReauthenticationMode to the Tomcat provided
Authenticators that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
+ Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
+ Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
+ Fix: Add log warnings for additional Host appBase suspicious values.
(remm)
+ Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
+ Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
+ Fix: Change the SSO reauthentication behaviour for SPNEGO authentication
so that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
+ Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential
NullPointerException. Identified by Coverity Scan. (markt)
+ Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
+ Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the
credential and salt are digested. By default, the current, non-RFC 3112
compliant, order of salt then credential will be used. This default will
change in Tomcat 12 to the RFC 3112 compliant order of credential then
salt. (markt)
* Cluster
+ Add: 62814: Document that human-readable names may be used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
+ Fix: Correct a regression introduced in 11.0.11 that broke some clustering
configurations. (markt)
* Coyote
+ Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown
that triggered a significant memory leak. Patch provided by Wes. (markt)
+ Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
+ Fix: Improve warnings when setting ciphers lists in the FFM code,
mirroring the tomcat-native changes. (remm)
+ Fix: 69910: Dereference TLS objects right after closing a socket to
improve memory efficiency. (remm)
+ Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the
other attributes. (markt)
+ Fix: Better warning message when OpenSSLConf configuration elements are
used with a JSSE TLS implementation. (markt)
+ Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
+ Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute
of an SSLHostConfig are now always ignored (previously they would be
ignored with OpenSSL implementations and used with JSSE implementations)
and a warning is logged that the cipher suite has been ignored. (markt)
+ Add: Add the ciphersuite attribute to SSLHostConfig to configure the
TLSv1.3 cipher suites. (markt)
+ Add: Add OCSP support to JSSE based TLS connectors and make the use of
OCSP configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those
performed by JSSE. (markt)
+ Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
+ Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
+ Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
(remm)
+ Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
+ Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
+ Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The
attribute default value is true, enabling the matching. (remm)
+ Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
+ Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
+ Fix: Fix potential crash on shutdown when a Connector depends on the
Tomcat Native library. (markt)
+ Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
(remm)
* Jasper
+ Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
+ Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
+ Fix: Fix populating the classpath with the webapp classloader
repositories. (remm)
+ Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
+ Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
+ Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
+ Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
+ Add: Documentation: Expand the documentation to better explain when OCSP
is supported and when it is not. (markt)
* Websocket
+ Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
* Other
+ Add: Add property "gpg.sign.files" to optionally disable release artefact
signing with GPG. (rjung)
+ Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
+ Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
+ Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
+ Update: Update Commons Daemon to 1.5.1. (markt)
+ Update: Update to the Eclipse JDT compiler 4.37. (markt)
+ Update: Update ByteBuddy to 1.18.3. (markt)
+ Update: Update UnboundID to 7.0.4. (markt)
+ Update: Update Checkstyle to 12.3.1. (markt)
+ Add: Improvements to French translations. (markt)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
+ Update: Update Tomcat Native to 2.0.12. (markt)
+ Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile=<name> to run specific test subsets without
using patterns directly. Profile patterns are defined in
test-profiles.properties. (csutherl)
+ Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.10. (markt)
+ Update: Update Commons Daemon to 1.5.0. (markt)
+ Update: Update Byte Buddy to 1.18.2. (markt)
+ Update: Update Checkstyle to 12.2.0. (markt)
+ Add: Improvements to Spanish translations provided by White Vogel. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
+ Update: Update to the Eclipse JDT compiler 4.37. (markt)
+ Update: Update to Byte Buddy 1.17.8. (markt)
+ Update: Update to Checkstyle 12.1.1. (markt)
+ Update: Update to Jacoco 0.8.14. (markt)
+ Update: Update to SpotBugs 4.9.8. (markt)
+ Update: Update to JSign 7.4. (markt)
+ Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
* Tue Nov 18 2025 Michele Bussolotto <michele.bussolotto@suse.com>
- make catalina.sh %config(noreplace) (bsc#1253460)
* Thu Nov 06 2025 Ricardo Mestre <ricardo.mestre@suse.com>
- Update to Tomcat 11.0.13
* Fixed CVEs:
+ CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT
is enabled (bsc#1252753)
+ CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control
Sequences vulnerability in Apache Tomcat (bsc#1252905)
+ CVE-2025-61795: temporary copies during the processing of multipart
upload can lead to a denial of service (bsc#1252756)
* Catalina
+ Add: Add CIDR support for the configuration of internal and trusted
proxies for the RemoteIpFilter and RemoteIpValve. Configuration via
regular expression has been deprecated and will be removed in Tomcat 12.
(markt)
+ Fix: Log warnings when the SSO configuration does not comply with the
documentation. (remm)
+ Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the
RemoteCIDRFilter and RemoteCIDRValve. (markt)
+ Fix: 69837: Fix corruption of the class path generated by the Loader when
running on Windows. (markt)
+ Fix: Reject requests that map to invalid Windows file names earlier.
(markt)
+ Fix: 69839: Ensure that changes to session IDs (typically after
authentication) are promulgated to the SSO Valve to ensure that SSO
entries are fully clean-up on session expiration. Patch provided by Kim
Johan Andersson. (markt)
+ Fix: Fix a race condition in the creation of the storage location for the
FileStore. (markt)
+ Update: Change the digest used to calculate strong ETags (if enabled) for
the default Servlet from SHA-1 to SHA-256 to align with the recommendation
in RFC 9110 that hash functions used to generate strong ETags should be
collision resistant. (markt)
+ Fix: HTTP methods are case-sensitive so always use case sensitive
comparisons when comparing HTTP methods. (markt)
+ Fix: 69814: Ensure that HttpSession.isNew() returns false once the client
has joined the session. (markt)
+ Fix: Further performance improvements for ParameterMap. (jengebr/markt)
+ Code: Refactor access log time stamps to be based on the Instant request
processing starts. (markt)
+ Fix: Fix a case-sensitivity issue in the trailer header allow list.
(markt)
+ Fix: Be proactive in cleaning up temporary files after a failed multi-part
upload rather than waiting for GC to do it. (markt)
+ Code: Remove a number of unnecessary packages from the
catalina-deployer.jar. (markt)
+ Fix: 69781: Fix concurrent access issues in the session FileStore
implementation that were causing lost sessions when the store was used
with the PersistentValve. Based on pull request #882 by Aaron Ogburn.
(markt)
+ Code: Refactor WebResource locking to use the new
KeyedReentrantReadWriteLock. (markt)
+ Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)
* Cluster
+ Fix: Prevent the channel configuration (sender, receiver, membership
service) from being changed unless the channel is fully stopped. (markt)
+ Fix: Handle spurious wake-ups during leader election for
NonBlockingCoordinator. (markt)
+ Fix: Handle spurious wake-ups during sending of messages by RpcChannel.
(markt)
* Coyote
+ Fix: 69836: Incorrect processing of partitioned setting when generating
session cookie. Patch submitted by Marc Pynaert. (remm)
+ Fix: 69848: Fix copy/paste errors in 11.0.12 that meant DELETE requests
received via the AJP connector were processed as OPTIONS requests and
PROPFIND requests were processed as TRACE. (markt)
+ Update: Add specific certificate selection code for TLS 1.3 supporting
post quantum cryptography. Certificates defined with type MLDSA will be
selected depending on the TLS client hello. (remm)
+ Update: Add groups attribute on SSLHostConfig allowing to restrict which
groups can be enabled on the SSL engine. (remm)
+ Add: Optimize the conversion of HTTP method from byte form to String form.
(markt)
+ Fix: Store HTTP request headers using the original case for the header
name rather than forcing it to lower case. (markt)
+ Fix: 69762: Additional overflow fix for HPACK decoding of integers. Pull
request #880 by Chenjp. (markt)
+ Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to
process it, with appropriate logging. (remm)
+ Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when
reading a key fails. (remm)
+ Fix: Fix possible early timeouts for network operations caused by a
spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)
* Web applications
+ Fix: Documentation. Clarify the purpose of the maxPostSize attribute of
the Connector element. (markt)
+ Fix: Avoid NPE in manager webapp displaying certificate information.
(remm)
* Websocket
+ Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the
underlying Inflater and/or Deflater throwing IllegalStateException when
closed rather than NullPointerException as they do in Java 24 and earlier.
(markt)
* Other
+ Fix: 69847: Remove remaining references to the
org.apache.tomcat.util.codec.binary package which has been deleted.
(markt)
+ Update: Update Byte Buddy to 1.17.7. (markt)
+ Update: Update Checkstyle to 11.1.0. (markt)
+ Update: Update SpotBugs to 4.9.6. (markt)
+ Update: Update Jsign to 7.2. (markt)
+ Add: Improvements to Russian translations provided by usmazat. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Minor refactoring in JULI loggers. Patch provided by minjund.
(schultz)
+ Code: Review logging and include the full stack trace and exception
message by default rather then just the exception message when logging an
error or warning in response to an exception. (markt)
+ Add: Add escaping to log formatters to align with JSON formatter. (markt)
+ Update: Update Checkstyle to 11.0.0. (markt)
* Wed Oct 01 2025 Fridrich Strba <fstrba@suse.com>
- Do not use update-alternatives
* Mon Aug 25 2025 Michele Bussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.10
* Fixed CVEs:
+ CVE-2025-48989: Update the HTTP/2 overhead documentation (bsc#1243895)
* Catalina
+ Fix: Fix bloom filter population for archive indexing when using a
packed WAR containing one or more JAR files. (markt)
* Coyote
+ Fix: 69748: Add missing call to set keep-alive timeout when using
HTTP/1.1 following an async request, which was present for AJP.
(remm/markt)
+ Fix: 69762: Fix possible overflow during HPACK decoding of integers.
Note that the maximum permitted value of an HPACK decoded integer is
Integer.MAX_VALUE. (markt)
+ Fix: Update the HTTP/2 overhead documentation - particularly the code
comments - to reflect the deprecation of the PRIORITY frame and
clarify that a stream reset always triggers an overhead increase.
(markt)
* Cluster
+ Update: Add enableStatistics configuration attribute for the
DeltaManager, defaulting to true. (remm)
* WebSocket
+ Fix: Align the WebSocket extension handling for WebSocket client
connections with WebSocket server connections. The WebSocket client
now only includes an extension requested by an endpoint in the
opening handshake if the WebSocket client supports that extension.
(markt)
* Web applications
+ Fix: Manager and Host Manager. Provide the Manager and Host Manager
web applications with a dedicated favicon file rather than using the
one from the ROOT web application which might not be present or may
represent something entirely different. Pull requests #876 and #878
by Simon Arame.
* Other
+ Update: Update Checkstyle to 10.26.1. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations by tak7iji. (markt)
* Wed Aug 06 2025 Michele Bussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.9
- adapt tomcat-jdt.patch
* Fixed CVEs:
+ CVE-2025-52520: Align size tracking for multipart requests with
FileUpload's use of long. (bsc#1246388)
+ CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier.
(bsc#1246318)
* Catalina
+ Fix: Ensure application configured welcome files override the defaults
when configuring an embedded web application programmatically. (markt)
+ Update: Optimize Request#getCharsetHolder to avoid repeated parsing when
charset is null. Patch provided by morning-gu. (schultz)
+ Fix: Allow the default servlet to set the content length when the content
length is known, no content has been written and a Writer is being used.
(markt)
+ Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that
prevented access to PreResources and PostResources when mounted below the
web application root with a path that was terminated with a file
separator. (remm/markt)
+ Fix: 69731: Fix an issue that meant that the value of maxParameterCount
applied was smaller than intended for multipart uploads with non-file
parts when the parts were processed before query string parameters.
(markt)
+ Fix: Align size tracking for multipart requests with FileUpload's use of
long. (schultz)
* Coyote
+ Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update
the documentation to provide more details on the memory requirements to
support multi-part uploads while avoiding a denial of service risk.
(markt)
+ Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding
when the headers include a content-length. (remm/markt)
+ Fix: Correctly collect statistics for HTTP/2 requests and avoid counting
one request multiple times. Based on pull request #868 by qingdaoheze.
(markt)
+ Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value
of useVirtualThreads in JMX. (remm)
+ Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional
certificate verification and improve the warnings when a web application
tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of
TLS 1.3. (markt)
+ Fix: When setting the initial HTTP/2 connection limit, apply those limits
earlier. (markt)
* Jasper
+ Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt)
+ Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL
grammar as both are unused. (markt)
* Web applications
+ Add: Documentation. Provide more explicit guidance regarding the security
considerations for enabling write access to the web application via
WebDAV, HTTP PUT requests or similar. (markt)
+ Add: Documentation. Add a section on reverse proxies to the security
considerations page. (markt)
* Other
+ Update: Update to the Eclipse JDT compiler 4.36. (markt)
+ Update: Update UnboundID to 7.0.3. (markt)
+ Update: Update Checkstyle to 10.25.1. (markt)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
* Tue Jun 24 2025 Michele Bussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.8
* Fixed CVEs:
+ CVE-2025-46701: refactor CGI servlet to access resources via
WebResources (bsc#1243815)
+ CVE-2025-48988: limits the total number of parts in a
multi-part request and limits the size of
the headers provided with each part (bsc#1244656)
+ CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)
* Catalina
+ Add: Support for the java:module namespace which mirrors the
java:comp namespace.
+ Fix: 69690: Calling HttpServletRequest.getParameter() and related
methods for a request with content type multipart/form-data when
the mapped servlet does not have a @MultipartConfig or equivalent
should not trigger an exception. Note that calling getPart() or
getParts() is these circumstances will trigger an exception.
+ Add: Support parsing of multiple path parameters separated by ; in a
single URL segment. Based on pull request #860 by Chenjp.
+ Fix: 69699: Encode redirect URL used by the rewrite valve with the
session id if appropriate, and handle cross context with different
session configuration when using rewrite.
+ Add: #863: Support for comments at the end of lines in text rewrite
map files to align behaviour with Apache httpd. Pull request
provided by Chenjp.
+ Fix: 69706: Saved request serialization issue in FORM introduced
when allowing infinite session timeouts.
+ Fix: Expand the path checks for Pre-Resources and Post-Resources
mounted at a path within the web application.
+ Fix: Process possible path parameters rewrite production in the
rewrite valve.
+ Fix: 69588: Enable allowLinking to be set on PreResources,
JarResources and PostResources. If not set explicitly, the setting
will be inherited from the Resources.
+ Add: 69633: Support for Filters using context root mappings.
+ Fix: 69643: Optimize directory listing for large amount of files.
Patch submitted by Loic de l'Eprevier.
+ Fix: #843: Off by one validation logic for partial PUT ranges and
associated test case. Submitted by Chenjp.
+ Refactor: GCI servlet to access resources via the WebResource API.
+ Fix: 69662: Report name in exception message when a naming lookup
failure occurs. Based on code submitted by Donald Smith.
+ Fix: Ensure that the FORM authentication attribute
authenticationSessionTimeout works correctly when sessions have an
infinite timeout when authentication starts.
+ Add: Provide a content type based on file extension when web
application resources are accessed via a URL.
* Coyote
+ Refactor: #861: TaskQueue to use the new interface RetryableQueue
which enables better integration of custom Executors which provide
their own BlockingQueue implementation. Pull request provided by
Paulo Almeida.
+ Add: Finer grained control of multi-part request processing via two
new attributes on the Connector element. maxPartCount limits the
total number of parts in a multi-part request and maxPartHeaderSize
limits the size of the headers provided with each part. Add support
for these new attributes to the ParameterLimitValve.
* Jasper
+ Fix: 69696: Mark the JSP wrapper for reload after a failed
compilation.
+ Fix: 69635: Add support to jakarta.el.ImportHandler for resolving
inner classes.
+ Add: #842: Support for optimized execution of c:set and c:remove
tags, when activated via JSP servlet param
useNonstandardTagOptimizations.
+ Fix: An edge case compilation bug for JSP and tag files on case
insensitive file systems that was exposed by the test case for
69635.
* Web applications
+ Fix: 69694: Improve error reporting of deployment tasks done using
the manager webapp when a copy operation fails.
+ Add: 68876: Documentation. Update the UML diagrams for server
start-up, request processing and authentication using PlantUML and
include the source files for each diagram.
* Other
+ Add: Thread name to webappClassLoader.stackTraceRequestThread
message. Patch provided by Felix Zhang.
+ Update: Tomcat Native to 2.0.9.
+ Update: The internal fork of Apache Commons FileUpload to 1.6.0-RC1
(2025-06-05).
+ Update: EasyMock to 5.6.0.
+ Update: Checkstyle to 10.25.0.
+ Fix: Use the full path when the installer for Windows sets calls
icacls.exe to set file permissions.
+ Update: Improvements to Japanese translations provided by tak7iji.
+ Update: Jacoco to 0.8.13.
+ Code: Explicitly set the locale to be used for Javadoc. For
official releases, this locale will be English (US) to support
reproducible builds.
+ Update: Byte Buddy to 1.17.5.
+ Update: Checkstyle to 10.23.1.
+ Update: File extension to media type mappings to align with the
current list used by the Apache Web Server (httpd).
+ Update: Improvements to French translations.
+ Update: Improvements to Japanese translations provided by tak7iji.
* Tue Jun 10 2025 Michele Bussolotto <michele.bussolotto@suse.com>
- Hardening permissions (bsc#1242722)
* Fri May 09 2025 Fridrich Strba <fstrba@suse.com>
- Do not require standalone versions of apis that tomcat itself
carries
- Do not version dependencies
* Fri May 02 2025 Fridrich Strba <fstrba@suse.com>
- Make conflicts and provides more generic
* Mon Apr 28 2025 Ricardo Mestre <ricardo.mestre@suse.com>
- Initial packaging of tomcat11 11.0.6
/etc/ant.d /etc/ant.d/catalina-ant /usr/share/java/tomcat /usr/share/java/tomcat/annotations-api.jar /usr/share/java/tomcat/catalina-ant.jar /usr/share/java/tomcat/catalina-ha.jar /usr/share/java/tomcat/catalina-ssi.jar /usr/share/java/tomcat/catalina-storeconfig.jar /usr/share/java/tomcat/catalina-tribes.jar /usr/share/java/tomcat/catalina.jar /usr/share/java/tomcat/commons-collections.jar /usr/share/java/tomcat/commons-dbcp2.jar /usr/share/java/tomcat/commons-pool2.jar /usr/share/java/tomcat/ecj.jar /usr/share/java/tomcat/jakartaee-migration.jar /usr/share/java/tomcat/jasper-el.jar /usr/share/java/tomcat/jasper-jdt.jar /usr/share/java/tomcat/jasper.jar /usr/share/java/tomcat/jaspic-api.jar /usr/share/java/tomcat/tomcat-api.jar /usr/share/java/tomcat/tomcat-coyote-ffm.jar /usr/share/java/tomcat/tomcat-coyote.jar /usr/share/java/tomcat/tomcat-dbcp.jar /usr/share/java/tomcat/tomcat-i18n-cs.jar /usr/share/java/tomcat/tomcat-i18n-de.jar /usr/share/java/tomcat/tomcat-i18n-es.jar /usr/share/java/tomcat/tomcat-i18n-fr.jar /usr/share/java/tomcat/tomcat-i18n-ja.jar /usr/share/java/tomcat/tomcat-i18n-ko.jar /usr/share/java/tomcat/tomcat-i18n-pt-BR.jar /usr/share/java/tomcat/tomcat-i18n-ru.jar /usr/share/java/tomcat/tomcat-i18n-zh-CN.jar /usr/share/java/tomcat/tomcat-jdbc.jar /usr/share/java/tomcat/tomcat-jni.jar /usr/share/java/tomcat/tomcat-jsp-4.0-api.jar /usr/share/java/tomcat/tomcat-juli.jar /usr/share/java/tomcat/tomcat-servlet-6.1-api.jar /usr/share/java/tomcat/tomcat-util-scan.jar /usr/share/java/tomcat/tomcat-util.jar /usr/share/java/tomcat/tomcat-websocket.jar /usr/share/java/tomcat/websocket-api.jar /usr/share/java/tomcat/websocket-client-api.jar /usr/share/maven-metadata/tomcat11.xml /usr/share/maven-poms/JPP.tomcat-annotations-api.pom /usr/share/maven-poms/JPP.tomcat-catalina-ha.pom /usr/share/maven-poms/JPP.tomcat-catalina-tribes.pom /usr/share/maven-poms/JPP.tomcat-catalina.pom /usr/share/maven-poms/JPP.tomcat-jasper-el.pom /usr/share/maven-poms/JPP.tomcat-jasper.pom /usr/share/maven-poms/JPP.tomcat-jaspic-api.pom /usr/share/maven-poms/JPP.tomcat-tomcat-api.pom /usr/share/maven-poms/JPP.tomcat-tomcat-coyote.pom /usr/share/maven-poms/JPP.tomcat-tomcat-dbcp.pom /usr/share/maven-poms/JPP.tomcat-tomcat-jdbc.pom /usr/share/maven-poms/JPP.tomcat-tomcat-jni.pom /usr/share/maven-poms/JPP.tomcat-tomcat-juli.pom /usr/share/maven-poms/JPP.tomcat-tomcat-util-scan.pom /usr/share/maven-poms/JPP.tomcat-tomcat-util.pom /usr/share/maven-poms/JPP.tomcat-tomcat-websocket.pom /usr/share/maven-poms/JPP.tomcat-websocket-api.pom /usr/share/maven-poms/JPP.tomcat-websocket-client-api.pom /usr/share/tomcat/bin /usr/share/tomcat/bin/tomcat-juli.jar
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Aug 3 00:04:55 2026