dev  

Messages by Date

• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 0dd86e53 markt
• 2026/09/30 (tomcat) 07/08: Make FrameworkListener registration idempotent so repeated Server start events do not add duplicate container listeners or orphan previous per-context lifecycle listeners that can no longer be removed remm
• 2026/09/30 (tomcat) 03/08: Return 0 rather than -1 for zero-length reads from InputBuffer at end of stream, as required by the InputStream/Reader contract, and avoid the unnecessary blocking fill these requests previously triggered remm
• 2026/09/30 (tomcat) 08/08: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/30 (tomcat) 05/08: Add spec-mandated validation to ApplicationServletRegistration: throw IllegalStateException when the registration is modified after the context has been initialised (using a deliberately lenient availability test to avoid breaking existing applications that configure registrations before start) and IllegalArgumentException from addMapping for null or empty URL patterns remm
• 2026/09/30 (tomcat) 06/08: Fall back to the raw trimmed filename value in ApplicationPart.getSubmittedFileName() when HttpParser.unquote() rejects an invalid quoted-string, keeping the result consistent with the file-vs-field classification performed by FileUploadBase.getFileName() for malformed Content-Disposition headers remm
• 2026/09/30 (tomcat) 04/08: Return a snapshot enumeration from Request.getLocales() to prevent ConcurrentModificationExceptions when the locales list is modified while a previously returned enumeration is being iterated remm
• 2026/09/30 (tomcat) 01/08: Fix InputBuffer.skip() consuming and returning more characters than requested by comparing and advancing by the remaining count (n - nRead) rather than the original count, and add a regression test remm
• 2026/09/30 (tomcat) 02/08: Record an error in CoyoteWriter.close() when the underlying OutputBuffer close fails, rather than swallowing the IOException silently, so checkError() reflects the failure remm
• 2026/09/30 (tomcat) branch 9.0.x updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) branch 10.1.x updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) branch 11.0.x updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) branch main updated: Follow-up to 09c0caced9 markt
• 2026/09/30 (tomcat) 06/07: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) 01/06: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 02/06: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 03/06: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) 06/06: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) branch 9.0.x updated (fee51e710c -> 99f7d442ac) remm
• 2026/09/30 (tomcat) 04/06: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) branch 10.1.x updated (4cb3350640 -> d852152140) remm
• 2026/09/30 (tomcat) 02/07: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 06/07: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) 03/07: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) 04/07: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) 01/07: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 05/07: Initialize the ServerAuthModule before caching the SingleModuleServerAuthContext so a failed initialization is not cached permanently and can be re-attempted on next use remm
• 2026/09/30 (tomcat) branch 11.0.x updated (5e9a552f97 -> 4c55e09d78) remm
• 2026/09/30 (tomcat) 04/07: Document that a failure to create a persistent JASPIC provider registration is deliberately fatal rather than silently skipped, since skipping an authentication provider would fail open remm
• 2026/09/30 (tomcat) 01/07: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 03/07: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) 07/07: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) 02/07: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 03/07: Load statically configured ServerAuthModule classes via the thread context (web application) class loader first, matching the pattern used for AuthConfigProvider classes, so modules packaged in WEB-INF/lib are found remm
• 2026/09/30 (tomcat) branch main updated (c2b1c9dab0 -> c817143f15) remm
• 2026/09/30 (tomcat) 07/07: Store the JASPIC isMandatory MessageInfo property as a Boolean as the specification requires rather than a String, and throw IllegalArgumentException rather than NullPointerException when null is passed to the MessageInfoImpl request/response message setters remm
• 2026/09/30 (tomcat) 01/07: Stop SSO session listeners accumulating on sessions by re-keying the SSO entry on session ID change without registering an additional listener remm
• 2026/09/30 (tomcat) 02/07: Guard SpnegoAuthenticator against missing JAAS/Kerberos config files, handle the unchecked SecurityException they would cause and log GSS ticket failures with the correct message remm
• 2026/09/30 (tomcat) 06/07: Update the JASPIC client Subject only when password validation succeeded (or was not requested), failing closed rather than adding a principal derived from untrusted caller-supplied data when validation failed remm
• 2026/09/30 (tomcat) branch 10.1.x updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/30 (tomcat) branch main updated: Explicitly state virtual host and SNI matching are separate markt
• 2026/09/29 [PR] Fix CharChunk.indexOf(char) for chunks with a non-zero start [tomcat] via GitHub
• 2026/09/29 [PR] Fix Map.Entry contract for CaseInsensitiveKeyMap entries [tomcat] via GitHub
• 2026/09/29 Buildbot failure in on tomcat-11.0.x buildbot
• 2026/09/29 Buildbot failure in on tomcat-12.0.x buildbot
• 2026/09/29 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/29 (tomcat) 06/13: Include the HTTP error response body in the error messages of the Manager Ant tasks remm
• 2026/09/29 Buildbot retry in on tomcat-10.1.x buildbot
• 2026/09/29 (tomcat) 13/14: Raise a BuildException when a JMX task or condition explicitly specifies a target that conflicts with an existing connection reference instead of silently ignoring it remm
• 2026/09/29 (tomcat) 08/13: Register the missing serverinfo Ant task in antlib.xml and catalina.tasks remm
• 2026/09/29 (tomcat) branch 11.0.x updated: Revert commit, with an explanation remm
• 2026/09/29 (tomcat) branch main updated: Revert commit, with an explanation remm
• 2026/09/29 (tomcat) 13/13: Log the error message returned by a JMX task when failOnError is false instead of discarding it remm
• 2026/09/29 (tomcat) 06/13: Include the HTTP error response body in the error messages of the Manager Ant tasks remm
• 2026/09/29 (tomcat) 11/13: Validate the operation and type in the JMX condition and report non-numeric values as a BuildException instead of an uncaught NumberFormatException or a silent false remm
• 2026/09/29 (tomcat) 03/13: Add configurable timeout for HTTP connections used by the Manager Ant tasks remm
• 2026/09/29 (tomcat) 01/13: Fix FindLeaksTask response constraint handling when statusLine is false remm
• 2026/09/29 (tomcat) 04/13: Avoid buffering remote WAR uploads of unknown length in memory in the Manager Ant tasks remm
• 2026/09/29 (tomcat) branch 9.0.x updated (ab60dfaaef -> 751734ac01) remm
• 2026/09/29 (tomcat) 12/13: Raise a BuildException when a JMX task or condition explicitly specifies a target that conflicts with an existing connection reference instead of silently ignoring it remm
• 2026/09/29 (tomcat) 10/13: Fail with a clear BuildException when a JMX string-to-type conversion is impossible instead of sending the raw String to the server remm
• 2026/09/29 (tomcat) 09/13: Close the JMX connection owned by a task or condition when no reference is used to share it remm
• 2026/09/29 (tomcat) 07/13: Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command remm
• 2026/09/29 (tomcat) 05/13: Align default URL-encoding charset of the Manager Ant tasks with the server default of UTF-8 remm
• 2026/09/29 (tomcat) 02/13: Remove unused internalid attribute from JKStatusUpdateTask remm
• 2026/09/29 (tomcat) 12/14: Validate the operation and type in the JMX condition and report non-numeric values as a BuildException instead of an uncaught NumberFormatException or a silent false remm
• 2026/09/29 (tomcat) 08/13: Register the missing serverinfo Ant task in antlib.xml and catalina.tasks remm
• 2026/09/29 (tomcat) 05/13: Align default URL-encoding charset of the Manager Ant tasks with the server default of UTF-8 remm
• 2026/09/29 (tomcat) 11/13: Validate the operation and type in the JMX condition and report non-numeric values as a BuildException instead of an uncaught NumberFormatException or a silent false remm
• 2026/09/29 (tomcat) 09/13: Close the JMX connection owned by a task or condition when no reference is used to share it remm
• 2026/09/29 (tomcat) 13/13: Log the error message returned by a JMX task when failOnError is false instead of discarding it remm
• 2026/09/29 (tomcat) 01/13: Fix FindLeaksTask response constraint handling when statusLine is false remm
• 2026/09/29 (tomcat) 03/13: Add configurable timeout for HTTP connections used by the Manager Ant tasks remm
• 2026/09/29 (tomcat) 07/13: Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command remm
• 2026/09/29 (tomcat) 10/13: Fail with a clear BuildException when a JMX string-to-type conversion is impossible instead of sending the raw String to the server remm
• 2026/09/29 (tomcat) 04/13: Avoid buffering remote WAR uploads of unknown length in memory in the Manager Ant tasks remm
• 2026/09/29 (tomcat) 02/13: Remove unused internalid attribute from JKStatusUpdateTask remm
• 2026/09/29 (tomcat) 12/13: Raise a BuildException when a JMX task or condition explicitly specifies a target that conflicts with an existing connection reference instead of silently ignoring it remm
• 2026/09/29 (tomcat) branch 10.1.x updated (85d60a3c37 -> 8d68bfa075) remm
• 2026/09/29 (tomcat) 09/14: Match the runtime default by blocking external entity resolution in the Validator Ant task remm
• 2026/09/29 (tomcat) 11/14: Fail with a clear BuildException when a JMX string-to-type conversion is impossible instead of sending the raw String to the server remm
• 2026/09/29 (tomcat) 14/14: Log the error message returned by a JMX task when failOnError is false instead of discarding it remm
• 2026/09/29 (tomcat) 10/14: Close the JMX connection owned by a task or condition when no reference is used to share it remm
• 2026/09/29 (tomcat) 06/14: Include the HTTP error response body in the error messages of the Manager Ant tasks remm
• 2026/09/29 (tomcat) 05/14: Align default URL-encoding charset of the Manager Ant tasks with the server default of UTF-8 remm
• 2026/09/29 (tomcat) 02/14: Remove unused internalid attribute from JKStatusUpdateTask remm
• 2026/09/29 (tomcat) 03/14: Add configurable timeout for HTTP connections used by the Manager Ant tasks remm
• 2026/09/29 (tomcat) branch 11.0.x updated (5ee1097e13 -> 21d8a2b6d9) remm
• 2026/09/29 (tomcat) 04/14: Avoid buffering remote WAR uploads of unknown length in memory in the Manager Ant tasks remm
• 2026/09/29 (tomcat) 07/14: Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command remm
• 2026/09/29 (tomcat) 08/14: Register the missing serverinfo Ant task in antlib.xml and catalina.tasks remm
• 2026/09/29 (tomcat) 01/14: Fix FindLeaksTask response constraint handling when statusLine is false remm
• 2026/09/29 Re: (tomcat) branch main updated (7a8da75d93 -> 96b998834e) Rémy Maucherat
• 2026/09/29 (tomcat) 01/15: Fix FindLeaksTask response constraint handling when statusLine is false remm
• 2026/09/29 (tomcat) 14/15: Log the error message returned by a JMX task when failOnError is false instead of discarding it remm
• 2026/09/29 (tomcat) 06/15: Include the HTTP error response body in the error messages of the Manager Ant tasks remm
• 2026/09/29 (tomcat) 12/15: Validate the operation and type in the JMX condition and report non-numeric values as a BuildException instead of an uncaught NumberFormatException or a silent false remm
• 2026/09/29 (tomcat) 09/15: Match the runtime default by blocking external entity resolution in the Validator Ant task remm
• 2026/09/29 (tomcat) 04/15: Avoid buffering remote WAR uploads of unknown length in memory in the Manager Ant tasks remm
• 2026/09/29 (tomcat) 15/15: Merge branch 'main' of [email protected]:apache/tomcat.git into main remm
• 2026/09/29 (tomcat) 13/15: Raise a BuildException when a JMX task or condition explicitly specifies a target that conflicts with an existing connection reference instead of silently ignoring it remm
• 2026/09/29 (tomcat) 08/15: Register the missing serverinfo Ant task in antlib.xml and catalina.tasks remm
• 2026/09/29 (tomcat) 03/15: Add configurable timeout for HTTP connections used by the Manager Ant tasks remm
• 2026/09/29 (tomcat) 02/15: Remove unused internalid attribute from JKStatusUpdateTask remm
• 2026/09/29 (tomcat) 11/15: Fail with a clear BuildException when a JMX string-to-type conversion is impossible instead of sending the raw String to the server remm
• 2026/09/29 (tomcat) 10/15: Close the JMX connection owned by a task or condition when no reference is used to share it remm
• 2026/09/29 (tomcat) 07/15: Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command remm
• 2026/09/29 (tomcat) 05/15: Align default URL-encoding charset of the Manager Ant tasks with the server default of UTF-8 remm
• 2026/09/29 (tomcat) branch main updated (7a8da75d93 -> 96b998834e) remm
• 2026/09/29 (tomcat) branch 10.1.x updated: Avoid very rare race between async write notification and completion remm
• 2026/09/29 (tomcat) branch 9.0.x updated: Avoid very rare race between async write notification and completion remm
• 2026/09/29 (tomcat) branch 11.0.x updated: Avoid very rare race between async write notification and completion remm
• 2026/09/29 (tomcat) branch 9.0.x updated: Ensure non-blocking write buffer is empty before sending AJP end msg markt
• 2026/09/29 (tomcat) branch 10.1.x updated: Ensure non-blocking write buffer is empty before sending AJP end msg markt
• 2026/09/29 (tomcat) branch 11.0.x updated: Ensure non-blocking write buffer is empty before sending AJP end msg markt
• 2026/09/29 (tomcat) branch main updated: Ensure non-blocking write buffer is empty before sending AJP end msg markt
• 2026/09/29 (tomcat) branch 11.0.x updated: Add test case for CVE-2026-78437 markt
• 2026/09/29 (tomcat) branch 9.0.x updated: Fix backport markt
• 2026/09/29 (tomcat) branch 10.1.x updated: Move to 27-ea remm
• 2026/09/29 [Bug 69949] Corrupted uploads from Safari on Tomcat 9/10/11 bugzilla
• 2026/09/29 (tomcat) branch main updated: Improve handling of Servlet 5.7 response closure markt
• 2026/09/29 (tomcat) branch main updated (19a8077cd3 -> e5a5d87495) markt
• 2026/09/29 (tomcat) branch 11.0.x updated: Improve handling of Servlet 5.7 response closure markt
• 2026/09/29 (tomcat) branch 9.0.x updated: Align flushing buffered writes with HTTP. markt
• 2026/09/29 (tomcat) branch 10.1.x updated: Align flushing buffered writes with HTTP. markt
• 2026/09/29 (tomcat) branch 11.0.x updated: Align flushing buffered writes with HTTP. markt
• 2026/09/29 (tomcat) branch main updated: Align flushing buffered writes with HTTP. markt
• 2026/09/29 Buildbot failure in on tomcat-10.1.x buildbot
• 2026/09/29 (tomcat) branch main updated: Clean-up - no functional change markt
• 2026/09/29 (tomcat) branch 9.0.x updated: Clean-up - no functional change markt
• 2026/09/29 (tomcat) branch 10.1.x updated: Clean-up - no functional change markt
• 2026/09/29 (tomcat) branch 11.0.x updated: Clean-up - no functional change markt
• 2026/09/29 (tomcat) branch 9.0.x updated: Add test case for CVE-2026-78437 markt
• 2026/09/29 Buildbot success in on tomcat-9.0.x buildbot
• 2026/09/29 (tomcat) branch 11.0.x updated: Add test case for CVE-2026-77791 markt
• 2026/09/29 (tomcat) 01/01: Merge pull request #1056 from apache/dependabot/github_actions/actions/setup-java-6 remm
• 2026/09/29 Re: NSIS 3.13 released ... Mark Thomas
• 2026/09/29 (tomcat) branch main updated: Avoid very rare race between async write notification and completion remm
• 2026/09/29 Re: Buildbot failure in on tomcat-9.0.x Mark Thomas
• 2026/09/29 Re: Buildbot failure in on tomcat-10.1.x Rainer Jung
• 2026/09/29 Re: Buildbot failure in on tomcat-9.0.x Rainer Jung
• 2026/09/29 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/29 NSIS 3.13 released ... Rainer Jung
• 2026/09/29 (tomcat) branch 10.1.x updated: Add test case for CVE-2026-78437 markt
• 2026/09/29 (tomcat) branch 9.0.x updated: Add test case for CVE-2026-77791 markt
• 2026/09/29 (tomcat) branch 10.1.x updated: Add test case for CVE-2026-77791 markt
• 2026/09/29 (tomcat) branch 9.0.x updated: Add test case for CVE-2026-77762 markt
• 2026/09/29 (tomcat) branch 10.1.x updated: Add test case for CVE-2026-77762 markt
• 2026/09/29 (tomcat) branch 11.0.x updated: Add test case for CVE-2026-77762 markt
• 2026/09/29 (tomcat) 01/03: Add test case for CVE-2026-77762 markt
• 2026/09/29 (tomcat) 02/03: Add test case for CVE-2026-77791 markt
• 2026/09/29 (tomcat) 03/03: Add test case for CVE-2026-78437 markt
• 2026/09/29 [Bug 70248] Uploads fail over HTTP/2: Tomcat closes the connection with "payload is [16777215] bytes long but the maximum frame size is [16384]" bugzilla
• 2026/09/29 Re: [PR] Bump actions/setup-java from 5 to 6 [tomcat] via GitHub
• 2026/09/29 Re: [PR] improve startup perf [tomcat] via GitHub
• 2026/09/29 Re: [PR] improve startup perf [tomcat] via GitHub
• 2026/09/29 (tomcat) branch main updated (a67bd12758 -> 19a8077cd3) remm
• 2026/09/29 (tomcat) branch dependabot/github_actions/actions/setup-java-6 deleted (was 52f6d081e0) github-bot
• 2026/09/29 (tomcat) branch 11.0.x updated: Move to 27-ea remm
• 2026/09/29 (tomcat) branch main updated: Drop 26 remm
• 2026/09/28 Re: [PR] Route JspC context logging through Ant [tomcat] via GitHub
• 2026/09/28 [PR] Route JspC context logging through Ant [tomcat] via GitHub
• 2026/09/28 [Bug 70249] EL in Tomcat 12-M1: NPE coerceToNumber() bugzilla
• 2026/09/28 [Bug 69890] Update test-status for more clear output bugzilla
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas via dev
• 2026/09/28 Re: [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas
• 2026/09/28 (tomcat-connectors) branch main updated: Better length checks when processing response header values. markt
• 2026/09/28 (tomcat-connectors) branch main updated: Add a lower bounds check for encoded response headers markt
• 2026/09/28 svn commit: r1938614 - in tomcat/site/trunk: docs xdocs markt
• 2026/09/28 (tomcat) branch 11.0.x updated: Add test case for bug 70249 markt
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas via dev
• 2026/09/28 (tomcat) branch 9.0.x updated: Add test case for bug 70249 markt
• 2026/09/28 (tomcat) branch 10.1.x updated: Add test case for bug 70249 markt
• 2026/09/28 [Bug 70249] EL in Tomcat 12-M1: NPE coerceToNumber() bugzilla
• 2026/09/28 (tomcat) branch main updated: Add test case for bug 70249 markt
• 2026/09/28 Re: [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas
• 2026/09/28 (tomcat) branch main updated: Fix a Coverity resource leak warning. markt
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas
• 2026/09/28 Buildbot success in on tomcat-11.0.x buildbot
• 2026/09/28 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/28 (tomcat) branch 10.1.x updated: Typos remm
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
• 2026/09/28 (tomcat) branch 11.0.x updated: Typos remm
• 2026/09/28 (tomcat) branch 9.0.x updated: Typos remm
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas via dev

• Earlier messages
• Later messages