SUSE-SU-2025:1521-1: tomcat&distro=openSUSE Leap 15.6
Published
Published 09-05-2025Last modified 04-02-2026
Vulnerability summary
SUSE-SU-2025:1521-1 is a vulnerability in tomcat&distro=openSUSE Leap 15.6 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 09-05-2025PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for tomcat This update for tomcat fixes the following issues: Update to Tomcat 9.0.104 - CVE-2025-31650: invalid priority field values should be ignored (bsc#1242008) - CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009) Full changelog: https://tomcat.apache.org/tomcat-9.0-doc/changelog.htm
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse14 products
- tomcat&distro=SUSE Enterprise Storage 7.1< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Server 15 SP5-LTSS< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 9.0.104-150200.81.1
- tomcat&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5< 9.0.104-150200.81.1
- tomcat&distro=SUSE Manager Server 4.3< 9.0.104-150200.81.1
Opensuse1 product
- tomcat&distro=openSUSE Leap 15.6< 9.0.104-150200.81.1
2 vendors · 15 products
References
5 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2026:0932-1opensuse · tomcat&distro=openSUSE Leap 15.6 +11 moreopensuse tomcat&distro=openSUSE Leap 15.6Security update for tomcat
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.115:
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
Changelog:
* Catalina
+ Fix: 69623: Additional fix for the long standing regression that meant
that calls to ClassLoader.getResource().getContent() failed when made from
within a web application with resource caching enabled if the target
resource was packaged in a JAR file. (markt)
+ Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
+ Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
+ Update: Update the minimum and recommended versions for Tomcat Native to
1.3.4. (markt)
+ Add: Add a new ssoReauthenticationMode to the Tomcat provided
Authenticators that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
+ Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
+ Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
+ Fix: Add log warnings for additional Host appBase suspicious values.
(remm)
+ Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
+ Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
+ Fix: Change the SSO reauthentication behaviour for SPNEGO authentication
so that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
+ Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential
NullPointerException. Identified by Coverity Scan. (markt)
+ Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
+ Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the
credential and salt are digested. By default, the current, non-RFC 3112
compliant, order of salt then credential will be used. This default will
change in Tomcat 12 to the RFC 3112 compliant order of credential then
salt. (markt)
* Cluster
+ Add: 62814: Document that human-readable names maybe used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
+ Fix: Correct a regression introduced in 9.0.109 that broke some clustering
configurations. (markt)
* Coyote
+ Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
+ Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)
+ Fix: Improve warnings when setting ciphers lists in the FFM code,
mirroring the tomcat-native changes. (remm)
+ Fix: 69910: Dereference TLS objects right after closing a socket to
improve memory efficiency. (remm)
+ Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the
other attributes. (markt)
+ Fix: Better warning message when OpenSSLConf configuration elements are
used with a JSSE TLS implementation. (markt)
+ Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
+ Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute
of an SSLHostConfig are now always ignored (previously they would be
ignored with OpenSSL implementations and used with JSSE implementations)
and a warning is logged that the cipher suite has been ignored. (markt)
+ Add: Add the ciphersuite attribute to SSLHostConfig to configure the
TLSv1.3 cipher suites. (markt)
+ Add: Add OCSP support to JSSE based TLS connectors and make the use of
OCSP configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those
performed by JSSE. (markt)
+ Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
+ Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
+ Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
+ Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
+ Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
+ Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The
attribute default value is true, enabling the matching. (remm)
+ Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
+ Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
+ Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
* Jasper
+ Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
+ Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
+ Fix: Fix populating the classpath with the webapp classloader
repositories. (remm)
+ Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
+ Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
+ Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
+ Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
+ Add: Documentation: Expand the documentation to better explain when OCSP
is supported and when it is not. (markt)
* Websocket
+ Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
* Other
+ Add: Add property 'gpg.sign.files' to optionally disable release artefact
signing with GPG. (rjung)
+ Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
+ Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
+ Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
+ Update: Update Commons Daemon to 1.5.1. (markt)
+ Update: Update ByteBuddy to 1.18.3. (markt)
+ Update: Update UnboundID to 7.0.4. (markt)
+ Update: Update Checkstyle to 12.3.1. (markt)
+ Add: Improvements to French translations. (markt)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
+ Update: Update Tomcat Native to 1.3.5. (markt)
+ Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile=<name> to run specific test subsets without
using patterns directly. Profile patterns are defined in
test-profiles.properties. (csutherl)
+ Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
+ Update: Update Commons Daemon to 1.5.0. (markt)
+ Update: Update Byte Buddy to 1.18.2. (markt)
+ Update: Update Checkstyle to 12.2.0. (markt)
+ Add: Improvements to Spanish translations provided by White Vogel. (markt)
+ Add: Improvements to French translations. (remm)
+ Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
+ Update: Update to Byte Buddy 1.17.8. (markt)
+ Update: Update to Checkstyle 12.1.1. (markt)
+ Update: Update to Jacoco 0.8.14. (markt)
+ Update: Update to SpotBugs 4.9.8. (markt)
+ Update: Update to JSign 7.4. (markt)
+ Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:4159-1opensuse · tomcat&distro=openSUSE Leap 15.6 +15 moreopensuse tomcat&distro=openSUSE Leap 15.6Security update for tomcat
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.111:
- CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT
is enabled (bsc#1252753)
- CVE-2025-55754: Fixed improper neutralization of escape, meta, or control
sequences vulnerability (bsc#1252905)
- CVE-2025-61795: Fixed denial of service due to temporary copies during
the processing of multipart upload (bsc#1252756)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:03024-1opensuse · tomcat&distro=openSUSE Leap 15.6 +15 moreopensuse tomcat&distro=openSUSE Leap 15.6Security update for tomcat
This update for tomcat fixes the following issues:
Updated to 9.0.108:
- CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388)
- CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)
- CVE-2025-52434: Fixed race condition on connection close when using the APR/Native connector leading to a JVM crash (bsc#1246389)
- CVE-2025-48989: Fixed 'MadeYouReset' DoS in HTTP/2 due to client triggered stream reset (bsc#1243895)
Other:
- Correct a regression in the fix for CVE-2025-49125 that
prevented access to PreResources and PostResources when mounted below the
web application root with a path that was terminated with a file
separator.CVSSUnscoredInsufficient evidenceSUSE-SU-2025:02280-1opensuse · tomcat&distro=openSUSE Leap 15.6 +15 moreopensuse tomcat&distro=openSUSE Leap 15.6Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).
- CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
- CVE-2025-49125: Fixed expand checks for webAppMount (bsc#1244649).
Other bugfixes:
- Made permissions more secure (bsc#1242722)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:1126-1opensuse · tomcat&distro=openSUSE Leap 15.6 +14 moreopensuse tomcat&distro=openSUSE Leap 15.6Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with partial PUT (bsc#1239302)
- Update to Tomcat 9.0.102
* Fixes:
+ launch with java 17 (bsc#1239676)
* Catalina
+ Fix: Weak etags in the If-Range header should not match as strong etags
are required. (remm)
+ Fix: When looking up class loader resources by resource name, the resource
name should not start with '/'. If the resource name does start with '/',
Tomcat is lenient and looks it up as if the '/' was not present. When the
web application class loader was configured with external repositories and
names starting with '/' were used for lookups, it was possible that cached
'not found' results could effectively hide lookup results using the
correct resource name. (markt)
+ Fix: Enable the JNDIRealm to validate credentials provided to
HttpServletRequest.login(String username, String password) when the realm
is configured to use GSSAPI authentication. (markt)
+ Fix: Fix a bug in the JRE compatibility detection that incorrectly
identified Java 19 and Java 20 as supporting Java 21 features. (markt)
+ Fix: Improve the checks for exposure to and protection against
CVE-2024-56337 so that reflection is not used unless required. The checks
for whether the file system is case sensitive or not have been removed.
(markt)
+ Fix: Avoid scenarios where temporary files used for partial PUT would not
be deleted. (remm)
+ Fix: 69602: Fix regression in releases from 12-2024 that were too strict
and rejected weak etags in the If-Range header. (remm)
+ Fix: 69576: Avoid possible failure initializing JreCompat due to uncaught
exception introduced for the check for CVE-2024-56337. (remm)
* Cluster
+ Add: 69598: Add detection of service account token changes to the
KubernetesMembershipProvider implementation and reload the token if it
changes. Based on a patch by Miroslav Jezbera. (markt)
* Coyote
+ Fix: 69575: Avoid using compression if a response is already compressed
using compress, deflate or zstd. (remm)
+ Update: Use Transfer-Encoding for compression rather than Content-Encoding
if the client submits a TE header containing gzip. (remm)
+ Fix: Fix a race condition in the handling of HTTP/2 stream reset that
could cause unexpected 500 responses. (markt)
* Other
+ Add: Add makensis as an option for building the Installer for Windows on
non-Windows platforms. (rjung/markt)
+ Update: Update Byte Buddy to 1.17.1. (markt)
+ Update: Update Checkstyle to 10.21.3. (markt)
+ Update: Update SpotBugs to 4.9.1. (markt)
+ Update: Update JSign to 7.1. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations by tak7iji. (markt)
+ Add: Add org.apache.juli.JsonFormatter to format log as one line JSON
documents. (remm)
- Update to Tomcat 9.0.99
* Catalina
+ Update: Add tableName configuration on the DataSourcePropertyStore that
may be used by the WebDAV Servlet. (remm)
+ Update: Improve HTTP If headers processing according to RFC 9110. Based on
pull request #796 by Chenjp. (remm/markt)
+ Update: Allow readOnly attribute configuration on the Resources element
and allow configure the readOnly attribute value of the main resources.
The attribute value will also be used by the default and WebDAV Servlets.
(remm)
+ Fix: 69285: Optimise the creation of the parameter map for included
requests. Based on sample code and test cases provided by John
Engebretson. (markt)
+ Fix: 69527: Avoid rare cases where a cached resource could be set with 0
content length, or could be evicted immediately. (remm)
+ Fix: Fix possible edge cases (such as HTTP/1.0) with trying to detect
requests without body for WebDAV LOCK and PROPFIND. (remm)
+ Fix: 69528: Add multi-release JAR support for the bloom
archiveIndexStrategy of the Resources. (remm)
+ Fix: Improve checks for WEB-INF and META-INF in the WebDAV servlet. Based
on a patch submitted by Chenjp. (remm)
+ Add: Add a check to ensure that, if one or more web applications are
potentially vulnerable to CVE-2024-56337, the JVM has been configured to
protect against the vulnerability and to configure the JVM correctly if
not. Where one or more web applications are potentially vulnerable to
CVE-2024-56337 and the JVM cannot be correctly configured or it cannot be
confirmed that the JVM has been correctly configured, prevent the impacted
web applications from starting. (markt)
+ Fix: Remove unused session to client map from CrawlerSessionManagerValve.
Submitted by Brian Matzon. (remm)
+ Fix: When using the WebDAV servlet with serveSubpathOnly set to true,
ensure that the destination for any requested WebDAV operation is also
restricted to the sub-path. (markt)
+ Fix: Generate an appropriate Allow HTTP header when the Default servlet
returns a 405 (method not allowed) response in response to a DELETE
request because the target resource cannot be deleted. Pull request #802
provided by Chenjp. (markt)
+ Code: Refactor creation of RequestDispatcher instances so that the
processing of the provided path is consistent with normal request
processing. (markt)
+ Add: Add encodedReverseSolidusHandling and encodedSolidusHandling
attributes to Context to provide control over the handling of the path
used to created a RequestDispatcher. (markt)
+ Fix: Handle a potential NullPointerException after an IOException occurs
on a non-container thread during asynchronous processing. (markt)
+ Fix: Enhance lifecycle of temporary files used by partial PUT. (remm)
* Coyote
+ Fix: Don't log warnings for registered HTTP/2 settings that Tomcat does
not support. These settings are now silently ignored. (markt)
+ Fix: Avoid a rare NullPointerException when recycling the
Http11InputBuffer. (markt)
+ Fix: Lower the log level to debug for logging an invalid socket channel
when processing poller events for the NIO Connector as this may occur in
normal usage. (markt)
+ Code: Clean-up references to the HTTP/2 stream once request processing has
completed to aid GC and reduce the size of the HTTP/2 recycled request and
response cache. (markt)
+ Add: Add a new Connector configuration attribute,
encodedReverseSolidusHandling, to control how %5c sequences in URLs are
handled. The default behaviour is unchanged (decode) keeping in mind that
the allowBackslash attribute determines how the decoded URI is processed.
(markt)
+ Fix: 69545: Improve CRLF skipping for the available method of the
ChunkedInputFilter. (remm)
+ Fix: Improve the performance of repeated calls to getHeader(). Pull
request #813 provided by Adwait Kumar Singh. (markt)
+ Fix: 69559: Ensure that the Java 24 warning regarding the use of
sun.misc.Unsafe::invokeCleaner is only reported by the JRE when the code
will be used. (markt)
* Jasper
+ Fix: 69508: Correct a regression in the fix for 69382 that broke JSP
include actions if both the page attribute and the body contained
parameters. Pull request #803 provided by Chenjp. (markt)
+ Fix: 69521: Update the EL Parser to allow the full range of valid
characters in an EL identifier as defined by the Java Language
Specification. (markt)
+ Fix: 69532: Optimise the creation of ExpressionFactory instances. Patch
provided by John Engebretson. (markt)
* Web applications
+ Add: Documentation. Expand the description of the security implications of
setting mapperContextRootRedirectEnabled and/or
mapperDirectoryRedirectEnabled to true. (markt)
+ Fix: Documentation. Better document the default for the truststoreProvider
attribute of a SSLHostConfig element. (markt)
* Other
+ Update: Update to Commons Daemon 1.4.1. (markt)
+ Update: Update the internal fork of Commons Pool to 2.12.1. (markt)
+ Update: Update Byte Buddy to 1.16.1. (markt)
+ Update: Update UnboundID to 7.0.2. (markt)
+ Update: Update Checkstyle to 10.21.2. (markt)
+ Update: Update SpotBugs to 4.9.0. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Chinese translations by leeyazhou. (markt)
+ Add: Improvements to Japanese translations by tak7iji. (markt)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:0058-1opensuse · tomcat&distro=openSUSE Leap 15.6 +14 moreopensuse tomcat&distro=openSUSE Leap 15.6Security update for tomcat
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.98
- Fixed CVEs:
+ CVE-2024-54677: DoS in examples web application (bsc#1234664)
+ CVE-2024-50379: RCE due to TOCTOU issue in JSP compilation (bsc#1234663)
+ CVE-2024-52317: Request/response mix-up with HTTP/2 (bsc#1233435)
- Catalina
+ Add: Add option to serve resources from subpath only with WebDAV Servlet
like with DefaultServlet. (michaelo)
+ Fix: Add special handling for the protocols attribute of SSLHostConfig in
storeconfig. (remm)
+ Fix: 69442: Fix case sensitive check on content-type when parsing request
parameters. (remm)
+ Code: Refactor duplicate code for extracting media type and subtype from
content-type into a single method. (markt)
+ Fix: Compatibility of generated embedded code with components where
constructors or property related methods throw a checked exception. (remm)
+ Fix: The previous fix for inconsistent resource metadata during concurrent
reads and writes was incomplete. (markt)
+ Fix: 69444: Ensure that the javax.servlet.error.message request attribute
is set when an application defined error page is called. (markt)
+ Fix: Avoid quotes for numeric values in the JSON generated by the status
servlet. (remm)
+ Add: Add strong ETag support for the WebDAV and default servlet, which can
be enabled by using the useStrongETags init parameter with a value set to
true. The ETag generated will be a SHA-1 checksum of the resource content.
(remm)
+ Fix: Use client locale for directory listings. (remm)
+ Fix: 69439: Improve the handling of multiple Cache-Control headers in the
ExpiresFilter. Based on pull request #777 by Chenjp. (markt)
+ Fix: 69447: Update the support for caching classes the web application
class loader cannot find to take account of classes loaded from external
repositories. Prior to this fix, these classes could be incorrectly marked
as not found. (markt)
+ Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by
users will not be removed and any header present in a HEAD request will
also be present in the equivalent GET request. There may be some headers,
as per RFC 9110, section 9.3.2, that are present in a GET request that are
not present in the equivalent HEAD request. (markt)
+ Fix: 69471: Log instances of CloseNowException caught by
ApplicationDispatcher.invoke() at debug level rather than error level as
they are very likely to have been caused by a client disconnection or
similar I/O issue. (markt)
+ Add: Add a test case for the fix for 69442. Also refactor references to
application/x-www-form-urlencoded. Based on pull request #779 by Chenjp.
(markt)
+ Fix: 69476: Catch possible ISE when trying to report PUT failure in the
DefaultServlet. (remm)
+ Add: Add support for RateLimit header fields for HTTP (draft) in the
RateLimitFilter. Based on pull request #775 provided by Chenjp. (markt)
+ Add: #787: Add regression tests for 69478. Pull request provided by Thomas
Krisch. (markt)
+ Fix: The default servlet now rejects HTTP range requests when two or more
of the requested ranges overlap. Based on pull request #782 provided by
Chenjp. (markt)
+ Fix: Enhance Content-Range verification for partial PUT requests handled
by the default servlet. Provided by Chenjp in pull request #778. (markt)
+ Fix: Harmonize DataSourceStore lookup in the global resources to
optionally avoid the comp/env prefix which is usually not used there.
(remm)
+ Fix: As required by RFC 9110, the HTTP Range header will now only be
processed for GET requests. Based on pull request #790 provided by Chenjp.
(markt)
+ Fix: Deprecate the useAcceptRanges initialisation parameter for the
default servlet. It will be removed in Tomcat 12 onwards where it will
effectively be hard coded to true. (markt)
+ Add: Add DataSource based property storage for the WebdavServlet. (remm)
- Coyote
+ Fix: Align encodedSolidusHandling with the Servlet specification. If the
pass-through mode is used, any %25 sequences will now also be passed
through to avoid errors and/or corruption when the application decodes the
path. (markt)
- Jasper
+ Fix: Further optimise EL evaluation of method parameters. Patch provided
by Paolo B. (markt)
+ Fix: Follow-up to the fix for 69381. Apply the optimisation for method
lookup performance in expression language to an additional location.
(markt)
- Web applications
+ Fix: Documentation. Remove references to the ResourceParams element.
Support for ResourceParams was removed in Tomcat 5.5.x. (markt)
+ Fix: Documentation. 69477: Correct name of attribute for RemoteIPFilter.
The attribute is internalProxies rather than allowedInternalProxies. Pull
request #786 (markt)
+ Fix: Examples. Fix broken links when Servlet Request Info example is
called via a URL that includes a pathInfo component. (markt)
+ Fix: Examples. Expand the obfuscation of session cookie values in the
request header example to JSON responses. (markt)
+ Add: Examples. Add the ability to delete session attributes in the servlet
session example. (markt)
+ Add: Examples. Add a hard coded limit of 10 attributes per session for the
servlet session example. (markt)
+ Add: Examples. Add the ability to delete session attributes and add a hard
coded limit of 10 attributes per session for the JSP form authentication
example. (markt)
+ Add: Examples. Limit the shopping cart example to only allow adding the
pre-defined items to the cart. (markt)
+ Fix: Examples. Remove JSP calendar example. (markt)
- Other
+ Fix: 69465: Fix warnings during native image compilation using the Tomcat
embedded JARs. (markt)
+ Update: Update Tomcat's fork of Commons DBCP to 2.13.0. (markt)
+ Update: Update EasyMock to 5.5.0. (markt)
+ Update: Update Checkstyle to 10.20.2. (markt)
+ Update: Update BND to 7.1.0. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Korean translations. (markt)
+ Add: Improvements to Chinese translations. (markt)
+ Add: Improvements to Japanese translations by tak7iji. (markt)CVSSUnscored