SUSE-SU-2025:02978-1: tomcat10&distro=openSUSE Leap 15.6
Published
Published 25-08-2025Last modified 23-03-2026
Vulnerability summary
SUSE-SU-2025:02978-1 is a vulnerability in tomcat10&distro=openSUSE Leap 15.6 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 3 · Downstream 0 · Related 3Timeline
- 25-08-2025PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
Security update for tomcat10 This update for tomcat10 fixes the following issues: Updated to Tomcat 10.1.43i: - CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388) - CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318) Other: - Correct a regression in the fix for CVE-2025-49125 that prevented access to PreResources and PostResources when mounted below the web application root with a path that was terminated with a file separator.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse6 products
- tomcat10&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 10.1.43-150200.5.48.1
- tomcat10&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 10.1.43-150200.5.48.1
- tomcat10&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6< 10.1.43-150200.5.48.1
- tomcat10&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7< 10.1.43-150200.5.48.1
- tomcat10&distro=SUSE Linux Enterprise Server 15 SP5-LTSS< 10.1.43-150200.5.48.1
- tomcat10&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5< 10.1.43-150200.5.48.1
Opensuse1 product
- tomcat10&distro=openSUSE Leap 15.6< 10.1.43-150200.5.48.1
2 vendors · 7 products
References
6 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2026:5073-1SUSE Linux Enterprisesuse · tomcat10&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS +6 moresuse tomcat10&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSecurity update for tomcat10
This update for tomcat10 fixes the following issues:
- CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
- CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
- CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).
- CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
- CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).
- CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362).
Changes:
Update to Tomcat 10.1.61:
* Catalina
+ Fix: When starting a web application, don't try and use the web
application class loader until after the web application class loader
has started. (markt)
+ Fix: various concurrency issues around adding and removing Realms from a
CombinedRealm, in particular doing so while the CombinedRealm is in use.
Note that once a Realm instance has been removed from a CombinedRealm
instance at run-time, the removed Realm instance may not be reused apart
from re-adding it to the same CombinedRealm. (markt)
+ Update: When StoreConfig re-writes an existing server.xml or context
configuration file, preserve the layout of the existing file (comments,
blank lines and attribute order) on a best effort basis. (remm)
+ Fix: Track in StandardContext whether the context was deployed from a
Context element in server.xml. Use it to have StoreConfig save to a new
config file. (remm)
+ Fix: Improve error handling on start-up. (markt)
+ Fix: byte range responses generated by DefaultServlet so a short
resource stream read does not truncate the response. Treat a premature
end of stream as an I/O error. Based on pull request #1067 by aoto-tech.
(markt)
+ Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw
an Error when FIPS is requested but not available. (markt)
+ Fix: Ensure that, as per the documentation, a simple bind is always used
when the JNDI realm binds using the user provided name and password to
authenticate the user. (markt)
+ Update: Optimize Accept-Language header processing and use of resource
budles for localization. (remm)
* Coyote
+ Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based
implementations of SSLEngine when the first flight of handshake messages
sent by the server is too large to fit in the buffer used by the BIO
pair. Patch submitted by Lukas Hellebrandt. (remm)
+ Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on
uploads. Submitted by Tim Burke. (remm)
+ Fix: Avoid very rare race between async write notification and
completion. Skip the write notification in these cases since it would be
useless. (remm)
+ Fix: a timing issue that could cause large non-blocking writes to stall
for AJP connections. (markt)
+ Fix: Ensure that the non-blocking write buffer is empty before sending
an AJP end response message. (markt)
+ Fix: CharChunk.indexOf(char) so that it searches from the start of the
chunk rather than from twice the chunk's start offset when the chunk
does not begin at the start of its buffer. (breken-ai)
+ Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when
part of the HTTP request body is received but not read. Based on a patch
provided by Guillaume Darmont. (markt)
+ Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it
is certain the JAR is not shared. (remm)
+ Fix: possible corruption of HTTP/1.1 chunked response bodies if a
previous write to a chunked body fails. (markt)
+ Fix: Align cipher order with the results produced by OpenSSL if the
cipher specification adds, removes and then re-adds ciphers. (markt)
+ Fix: Correct a narrow race condition when processing HTTP/2 headers.
+ Fix: possible TLS connections failures caused by one of the flags Tomcat
uses to track TLS handshake progress not being correctly reset. (markt)
+ Fix: Allow for absolute host names in SNI checks. (markt)
+ Fix: Correct a gap in asynchronous error handling that could lead to
unexpected IllegalStateExceptions for some error conditions. (markt)
+ Add: Harden HTTP/2 against applications that do not correctly handle
asynchronous errors. (markt)
* Jasper
+ Fix: Route JspC servlet context logging through Ant when used as an Ant
task. (sainadh777)
+ Fix: the tag plugin for the JSTL <c:redirtect> tag so that page
processing ends with the redirect. (markt)
* Web applications
+ Add: Documentation: Explicitly state that virtual host matching via the
HTTP host header and TLS configuration matching via SNI are completely
separate processes. (markt)
+ Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the
WebSocket drawboard. (sainadh777)
* Other
+ Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)
+ Update: to NSIS 3.13. (markt)
+ Update: to Byte Buddy 1.18.14. (markt)
+ Update: to Bouncy Castle 1.8.6. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: to Migration tool for Jakarta EE 1.0.13. (markt)
* Cluster
+ Fix: Replicate SSO session key set changes made by removeSession() and
sessionChangedId() in ClusterSingleSignOn so that SSO entries are
correctly deregistered and removed from all nodes when the last
associated session expires, even when the sessions expire on different
cluster nodes. (remm)
+ Fix: Move context attributes that were set while the web application was
still starting into the replicated attribute map when it is installed in
ReplicatedContext, so that they are replicated to the other nodes like
attributes set later on rather than remaining local to the node that
started the application. (remm)
+ Fix: a possible deadlock in DeltaSession.expire(): the final session
delta is now captured and sent to the cluster before the session monitor
is acquired, because obtaining the delta takes the delta lock and code
that runs while the delta lock is held, such as session attribute
listener notifications, may in turn wait for the session monitor. (remm)
+ Fix: Fire the documented send_message_failure lifecycle event with the
message, destination and exception when a SimpleTcpCluster message send
fails and notifyLifecycleListenerOnFailure is enabled. The event was
previously declared but never fired. (remm)
+ Fix: a possible deadlock in DeltaSession: session attribute listeners
are no longer called while the delta lock is held when attributes are
set or removed. The delta lock is only held while the change is
recorded. (markt)
+ Fix: a possible deadlock in DeltaSession: received session deltas are
now read into a separate DeltaRequest from the one the session uses to
record local changes. This avoids having to hold the delta lock while
processing received changes. (markt)
+ Fix: an issue replicating SessionListener additions and removals that
meant some modification were not replicated leading to inconsistent
listener configurations across the cluster. (markt)
* Tribes
+ Docs: Document Tribes channel, membership, transport and replication
status available through JMX. Based on pull request #1071 by sainadh777.CVSSUnscoredInsufficient evidenceSUSE-SU-2026:0890-1opensuse · tomcat10&distro=openSUSE Leap 15.6 +7 moreopensuse tomcat10&distro=openSUSE Leap 15.6Security update for tomcat10
This update for tomcat10 fixes the following issues:
Update to Tomcat 10.1.52:
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
Changelog:
* Catalina
+ Fix: 69623: Additional fix for the long standing regression that meant
that calls to ClassLoader.getResource().getContent() failed when made from
within a web application with resource caching enabled if the target
resource was packaged in a JAR file. (markt)
+ Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
+ Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
+ Update: Enable minimum and recommended Tomcat Native versions to be set
separately for Tomcat Native 1.x and 2.x. Update the minimum and
recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum
and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
+ Add: Add a new ssoReauthenticationMode to the Tomcat provided
Authenticators that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
+ Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
+ Fix: 69932: Fix request end access log pattern regression, which would log
the start time of the request instead. (remm)
+ Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
+ Fix: Add log warnings for additional Host appBase suspicious values.
(remm)
+ Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
+ Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
+ Fix: Change the SSO reauthentication behaviour for SPNEGO authentication
so that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
+ Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential
NullPointerException. Identified by Coverity Scan. (markt)
+ Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
+ Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the
credential and salt are digested. By default, the current, non-RFC 3112
compliant, order of salt then credential will be used. This default will
change in Tomcat 12 to the RFC 3112 compliant order of credential then
salt. (markt)
+ Fix: Log warnings when the SSO configuration does not comply with the
documentation. (remm)
+ Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of
the RemoteCIDRFilter and RemoteCIDRValve. (markt)
+ Fix: 69837: Fix corruption of the class path generated by the Loader when
running on Windows. (markt)
+ Fix: Reject requests that map to invalid Windows file names earlier.
(markt)
+ Fix: 69839: Ensure that changes to session IDs (typically after
authentication) are promulgated to the SSO Valve to ensure that SSO
entries are fully clean-up on session expiration. Patch provided by Kim
Johan Andersson. (markt)
+ Fix: Fix a race condition in the creation of the storage location for the
FileStore. (markt)
* Cluster
+ Add: 62814: Document that human-readable names may be used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
+ Fix: Correct a regression introduced in 10.1.45 that broke some clustering
configurations. (markt)
* Coyote
+ Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown
that triggered a significant memory leak. Patch provided by Wes. (markt)
+ Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)
+ Fix: Improve warnings when setting ciphers lists in the FFM code,
mirroring the tomcat-native changes. (remm)
+ Fix: 69910: Dereference TLS objects right after closing a socket to
improve memory efficiency. (remm)
+ Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the
other attributes. (markt)
+ Fix: Better warning message when OpenSSLConf configuration elements are
used with a JSSE TLS implementation. (markt)
+ Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
+ Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute
of an SSLHostConfig are now always ignored (previously they would be
ignored with OpenSSL implementations and used with JSSE implementations)
and a warning is logged that the cipher suite has been ignored. (markt)
+ Add: Add the ciphersuite attribute to SSLHostConfig to configure the
TLSv1.3 cipher suites. (markt)
+ Add: Add OCSP support to JSSE based TLS connectors and make the use of
OCSP configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those
performed by JSSE. (markt)
+ Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
+ Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
+ Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
+ Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
+ Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
+ Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
+ Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The
attribute default value is true, enabling the matching. (remm)
+ Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
+ Fix: Fix use of deferAccept attribute in JMX, since it is normally only
removed in Tomcat 11. (remm)
+ Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
+ Fix: Fix potential crash on shutdown when a Connector depends on the
Tomcat Native library. (markt)
+ Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
+ Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests
received via the AJP connector were processed as OPTIONS requests and
PROPFIND requests were processed as TRACE. (markt)
+ Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis)
* General
+ Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
* Jasper
+ Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
+ Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
+ Fix: Fix populating the classpath with the webapp classloader
repositories. (remm)
+ Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
+ Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
+ Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
+ Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
+ Add: Documentation: Expand the documentation to better explain when OCSP
is supported and when it is not. (markt)
* Websocket
+ Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
+ Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the
underlying Inflater and/or Deflater throwing IllegalStateException when
closed rather than NullPointerException as they do in Java 24 and earlier.
* Other
+ Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
+ Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
+ Update: Update Commons Daemon to 1.5.1. (markt)
+ Update: Update ByteBuddy to 1.18.3. (markt)
+ Update: Update UnboundID to 7.0.4. (markt)
+ Update: Update Checkstyle to 12.3.1. (markt)
+ Add: Improvements to French translations. (markt)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
+ Update: Update Tomcat Native to 2.0.12. (markt)
+ Add: Add property 'gpg.sign.files' to optionally disable release artefact
signing with GPG. (rjung)
+ Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile=<name> to run specific test subsets without
using patterns directly. Profile patterns are defined in
test-profiles.properties. (csutherl)
+ Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.10. (markt)
+ Update: Update Commons Daemon to 1.5.0. (markt)
+ Update: Update Byte Buddy to 1.18.2. (markt)
+ Update: Update Checkstyle to 12.2.0. (markt)
+ Add: Improvements to Spanish translations provided by White Vogel. (markt)
+ Add: Improvements to French translations. (remm)
+ Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
+ Update: Update to Byte Buddy 1.17.8. (markt)
+ Update: Update to Checkstyle 12.1.1. (markt)
+ Update: Update to Jacoco 0.8.14. (markt)
+ Update: Update to SpotBugs 4.9.8. (markt)
+ Update: Update to JSign 7.4. (markt)
+ Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:4103-1opensuse · tomcat10&distro=openSUSE Leap 15.6 +6 moreopensuse tomcat10&distro=openSUSE Leap 15.6Security update for tomcat10
This update for tomcat10 fixes the following issues:
Update to Tomcat 10.1.48
- CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT
is enabled (bsc#1252753)
- CVE-2025-55754: Fixed improper neutralization of escape, meta, or control
sequences vulnerability (bsc#1252905)
- CVE-2025-61795: Fixed denial of service due to temporary copies during
the processing of multipart upload (bsc#1252756)CVSSUnscoredPrioritiseCVE-2025-48989apache software foundation · apache tomcat +24 moreApache Tomcat: h2 DoS - Made You ResetImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.
Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.CVSS7.5HighEPSS3.77%Insufficient evidenceSUSE-SU-2025:02261-1opensuse · tomcat10&distro=openSUSE Leap 15.6 +6 moreopensuse tomcat10&distro=openSUSE Leap 15.6Security update for tomcat10
This update for tomcat10 fixes the following issues:
- Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
- Fixed limits the total number of parts in a multi-part request and
limits the size of the headers provided with each part (bsc#1244656).
- Fixed expand checks for webAppMount (bsc#1244649).
- Hardening permissions (bsc#1242722)
Update to Tomcat 10.1.42:
* Fixed CVEs:
+ CVE-2025-46701: refactor CGI servlet to access resources via
WebResources (bsc#1243815)
+ CVE-2025-48988: limits the total number of parts in a
multi-part request and limits the size of
the headers provided with each part (bsc#1244656)
+ CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)
* Catalina:
+ Add: Support for the java:module namespace which mirrors the
java:comp namespace.
+ Add: Support parsing of multiple path parameters separated by ; in a
single URL segment. Based on pull request #860 by Chenjp.
+ Add: Support for limiting the number of parameters in HTTP requests
through the new ParameterLimitValve. The valve allows configurable
URL-specific limits on the number of parameters.
+ Fix: 69699: Encode redirect URL used by the rewrite valve with the
session id if appropriate, and handle cross context with different
session configuration when using rewrite.
+ Add: #863: Support for comments at the end of lines in text rewrite
map files to align behaviour with Apache httpd. Pull request
provided by Chenjp.
+ Fix: 69706: Saved request serialization issue in FORM introduced
when allowing infinite session timeouts.
+ Fix: Expand the path checks for Pre-Resources and Post-Resources
mounted at a path within the web application.
+ Fix: Use of SSS in SimpleDateFormat pattern for AccessLogValve.
+ Fix: Process possible path parameters rewrite production in the
rewrite valve.
+ Fix: 69588: Enable allowLinking to be set on PreResources,
JarResources and PostResources. If not set explicitly, the setting
will be inherited from the Resources.
+ Add: 69633: Support for Filters using context root mappings.
+ Fix: 69643: Optimize directory listing for large amount of files.
Patch submitted by Loic de l'Eprevier.
+ Fix: #843: Off by one validation logic for partial PUT ranges and
associated test case. Submitted by Chenjp.
+ Refactor: Replace the unused buffer in
org.apache.catalina.connector.InputBuffer with a static, zero
length buffer.
+ Refactor: GCI servlet to access resources via the WebResource API.
+ Fix: 69662: Report name in exception message when a naming lookup
failure occurs. Based on code submitted by Donald Smith.
+ Fix: Ensure that the FORM authentication attribute
authenticationSessionTimeout works correctly when sessions have an
infinite timeout when authentication starts.
+ Add: Provide a content type based on file extension when web
application resources are accessed via a URL.
* Coyote
+ Refactor: #861: TaskQueue to use the new interface RetryableQueue
which enables better integration of custom Executors which provide
their own BlockingQueue implementation. Pull request provided by
Paulo Almeida.
+ Add: Finer grained control of multi-part request processing via two
new attributes on the Connector element. maxPartCount limits the
total number of parts in a multi-part request and maxPartHeaderSize
limits the size of the headers provided with each part. Add support
for these new attributes to the ParameterLimitValve.
+ Refactor: The SavedRequestInputFilter so the buffered data is used
directly rather than copied.
* Jasper:
+ Fix: 69696: Mark the JSP wrapper for reload after a failed
compilation.
+ Fix: 69635: Add support to jakarta.el.ImportHandler for resolving
inner classes.
+ Add: #842: Support for optimized execution of c:set and c:remove
tags, when activated via JSP servlet param
useNonstandardTagOptimizations.
+ Fix: An edge case compilation bug for JSP and tag files on case
insensitive file systems that was exposed by the test case for
69635.
* Web applications:
+ Fix: 69694: Improve error reporting of deployment tasks done using
the manager webapp when a copy operation fails.
+ Add: 68876: Documentation. Update the UML diagrams for server
start-up, request processing and authentication using PlantUML and
include the source files for each diagram.
* Other:
+ Add: Thread name to webappClassLoader.stackTraceRequestThread
message. Patch provided by Felix Zhang.
+ Update: Tomcat Native to 2.0.9.
+ Update: The internal fork of Apache Commons FileUpload to 1.6.0-RC1
(2025-06-05).
+ Update: EasyMock to 5.6.0.
+ Update: Checkstyle to 10.25.0.
+ Fix: Use the full path when the installer for Windows sets calls
icacls.exe to set file permissions.
+ Update: Improvements to Japanese translations provided by tak7iji.
+ Fix: Set sun.io.useCanonCaches in service.bat Based on pull request
#841 by Paul Lodge.
+ Update: Jacoco to 0.8.13.
+ Code: Explicitly set the locale to be used for Javadoc. For
official releases, this locale will be English (US) to support
reproducible builds.
+ Update: Byte Buddy to 1.17.5.
+ Update: Checkstyle to 10.23.1.
+ Update: File extension to media type mappings to align with the
current list used by the Apache Web Server (httpd).
+ Update: Improvements to French translations.
+ Update: Improvements to Japanese translations provided by tak7iji.CVSSUnscoredInsufficient evidenceSUSE-SU-2025:1537-1opensuse · tomcat10&distro=openSUSE Leap 15.6 +5 moreopensuse tomcat10&distro=openSUSE Leap 15.6Security update for tomcat10
This update for tomcat10 fixes the following issues:
Update to Tomcat 10.1.40
- CVE-2025-31650: invalid priority field values should be ignored (bsc#1242008)
- CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009)
Full changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.htmlCVSSUnscored