Am 26.08.2026 um 22:14 schrieb Darryl Baker:
I am trying to figure out when a vulnerability justifies and out of cycle update to our Tomcat installations.
Hey Darryl,
I think you need experts with deep knowledge of your applications and
your setup to assess whether and how much you're affected by a
vulnerability.
For example, if you run Tomcat behind an Apache httpd reverse proxy, use
AJP between httpd and Tomcat and don't expose your Tomcat to the
Internet, you won't have to worry about HTTP2 issues. If you don't use
any security constraints on the Tomcat level and have this inside your
application, you don't need to be worried about security constraints in
web.xml not working properly. And the list goes on. So I wouldn't focus
too much on the general rating of a bug.
On the contrary, if you run a certain edge case, you could be severely
affected by a vulnerability that is just classified "low".
Best regards,
Reg Barclay
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
