SUSE-SU-2025:21152-1: tomcat11&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise
Published
Published 27-11-2025Last modified 23-03-2026
Vulnerability summary
SUSE-SU-2025:21152-1 is a vulnerability in tomcat11&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 3 · Downstream 0 · Related 3Timeline
- 27-11-2025PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
Security update for tomcat11 This update for tomcat11 fixes the following issues: Update to Tomcat 11.0.13: - CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753). - CVE-2025-55754: Fixed Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat (bsc#1252905). - CVE-2025-61795: Fixed temporary copies during the processing of multipart upload can lead to a denial of service (bsc#1252756).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse2 products
- tomcat11&distro=SUSE Linux Enterprise Server 16.0< 11.0.13-160000.1.1
- tomcat11&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 11.0.13-160000.1.1
1 vendor · 2 products
References
7 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2026:23985-1SUSE Linux Enterprisesuse · libtcnative-1-0&distro=SUSE Linux Enterprise Server 16.0 +9 moresuse libtcnative-1-0&distro=SUSE Linux Enterprise Server 16.0Security update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11
This update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11 fixes the following issues:
Security issues fixed:
- CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
(bsc#1282631).
- CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider`
(bsc#1282630).
- CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
- CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user
to fail when Tomcat is located behind a reverse proxy (bsc#1282628).
- CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers (bsc#1282599).
- CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack
(bsc#1282627).
- CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an
AJP processing thread leading to denial of service (bsc#1282626).
- CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail
(bsc#1282625).
- CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for
denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).
- CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash
(bsc#1282623).
- CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and
ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
- CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some
configurations (bsc#1282621).
- CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
(bsc#1282620).
- CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).
- CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with (bsc#1282581).
Non security issue fixed:
- package libtcnative-1-0-devel houses link to libtcnative-1.so instead of package libtcnative-1-0 (bsc#622430).
Changes for libtcnative-1-0:
- Update to 1.3.9
+ Code: Remove call to ERR_remove_thread_state() from Windows
specific code to allow building with OpenSSL 4.0.x.
ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got
removed in OpenSSL 4
+ Fix: Fix a potential crash when negotiating ALPN
+ If ALPN negotiation fails and failure is configured to use
the last server protocol in the list, use it rather than the
last protocol offered by the client
+ Fix: Add support for the extended range of options available
from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned
int (represented by a Java long) rather than a 32-bit unsigned
int (represented by a Java int)
+ Code: Remove unused code
+ Ensure that per connection changes to certificate verification
settings, e.g. to support client certificate authentication,
do not modify the certificate verification settings for other
connections
+ Fix: Fix a potential crash when configuring raw certificates
+ Fix: Avoid a potential crash with very long ALPN protocol
names
+ Fix: Make the call to a CertificateVerifier more robust
+ Fix: Avoid a potential crash when processing OCSP URLs
+ Fix: Make the processing of OCSP responses more robust
+ Fix: Stricter OCSP handling when soft-fail is disabled
+ Fix: Harden against the mis-use of Buffer.address(ByteBuffer)
+ Fix: Harden against the mis-use of Pool.destroy(long)
+ Code: The minimum supported OpenSSL version is now 3.0.x.
OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no
bug reports were receive for that failure and since both
Debian and Ubuntu versions that used OpenSSL 1.1.1 have
reached end of support, OpenSSL 1.1.1 is no longer supported
+ Update: OpenSSL 3.0.x is approaching end of support so the
recommended version of OpenSSL (and the version that windows
binaries will be built with) now follows the 3.5.x LTS branch
+ Fix: Switch to automatic configuration of DH parameters.
Manual configuration attempts will be ignored
+ Code: Make setTmpECDHByCurveName() a NO-OP
+ Fix: Refactor extraction of ECDH curve name from the
Certificate to avoid deprecated OpenSSL methods
+ Fix: Refactor the native implementation of SSL.getTime() to
avoid the Y2038 problem in SSL_SESSION_get_time() when running
on a verion of OpenSSL that includes the new
SSL_SESSION_get_time_ex() method
Changes for libtcnative-2-0:
- Upgrade to version 2.0.16
+ Code: Remove call to ERR_remove_thread_state() from Windows
specific code to allow building with OpenSSL 4.0.x
ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got
removed in OpenSSL 4
+ Update: Remove support for Windows build on IA64 architecture
(Itanium)
+ Update: Make x64 the default architecture for Windows build
+ Update: Make Windows 10 / 11 the default target version for
Windows builds
+ Fix: Fix a potential crash when negotiating ALPN
+ Fix: If ALPN negotiation fails and failure is configured to
use the last server protocol in the list, use it rather than
the last protocol offered by the client
+ Fix: Add support for the extended range of options available
from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned
int (represented by a Java long) rather than a 32-bit unsigned
int (represented by a Java int)
+ Code: Remove unused code
+ Fix: Ensure that per connection changes to certificate
verification settings, e.g. to support client certificate
authentication, do not modify the certificate verification
settings for other connections
+ Fix: Fix a potential crash when configuring raw certificates
+ Fix: Avoid a potential crash with very long ALPN protocol
names
+ Fix: Make the call to a CertificateVerifier more robust
+ Fix: Avoid a potential crash when processing OCSP URLs
+ Fix: Make the processing of OCSP responses more robust
+ Fix: Stricter OCSP handling when soft-fail is disabled
+ Fix: Harden against the mis-use of Buffer.address(ByteBuffer)
+ Fix: Harden against the mis-use of Pool.destroy(long)
Changes for tomcat10:
- Update to Tomcat 10.1.60
+ Fix: When a PersistentManager needs to reduce the number of active
sessions, swap out the least recently used eligible sessions first. Pull
request #1045 provided by sainadh777. (markt)
+ Fix: Align web.xml logging output with the new Context attribute
urlPatternsProvidedInDecodedForm. (markt)
+ Fix: Improve robustness of DIGEST authentication to system clock jumps.
(markt)
+ Add: Support multiple protocol header values (treat as a single merged
header value) in the RemoteIpFilter and RemoteIpValve. (markt)
+ Fix: potential concurrency issues when loading/saving sessions from/to a
session store. Custom Store implementations that do not extend StoreBase
must implement the new getSessionStoreLock() method of the Store
interface to ensure concurrency protection. The default method
implementation provided only provides the pre-fix functionality. (markt)
+ Fix: Ensure that PersistentManager implementations that extend
PersistentManagerBase do not swap out sessions that are associated with
a request that is currently being processed. This includes not swapping
out a session unless the session was created when activity tracking was
enabled. (markt)
+ Fix: Ensure namespace attributes are XML escaped in WebDAV responses.
+ Fix: Resolve null or missing rewrite substitutions as an empty string,
to align with the mod_rewrite behavior. (remm)
+ Add: a best efforts protection in the CrawlerSessionManagerValve against
crawlers being associated with an authenticated session. (markt)
+ Fix: Clarify the meaning of various RewriteValve server variables and
explicitly use the canonical context path for the CONTEXT_PATH server
variable. (markt)
+ Fix: storeconfig not saving the path when a context is saved in
server.xml. (remm)
+ Fix: WAR URLConnection should propagate use of caching. (remm)
+ Fix: Ensure resources are evicted from the static resource cache in the
correct order. (markt)
+ Fix: When Jakarta Authentication is configured for a web application,
cache the ServerAuthConfig in the Authenticator valve. This ensures web
application specific settings are cached on a per web application basis.
+ Fix: 70203: Fix RegistrationListener notifications in Jakarta
Authentication implementation. (markt)
+ Fix: Handle CGI scripts that write excessively to stdout after setting
an HTTP error status code. (schultz)
+ Fix: Require the request to the login action during FORM authentication
to be made using HTTP POST. (markt)
+ Fix: 70208: Make URL encoding more robust. Based on pull request #1065
by Chenjp. (markt)
* Coyote
+ Fix: xreflection generated code stack overflow issue. (remm)
+ Fix: Align xreflection better with IntrospectionUtils. (remm)
+ Fix: In HTTP/2 after half closed (remote), any unexpected frame should
be a stream error. (remm)
+ Fix: incorrect initial window size calculation when upgrading to HTTP/2.
(remm)
+ Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)
+ Fix: Only try and load the native library from the CATALINA_HOME system
property when the property is set. (markt)
+ Fix: max connections enforcement after an enpoint resume. (remm)
+ Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)
+ Add: length validation for ALPN protocol names. (markt)
+ Fix: Make FFM certificate verification more robust. (markt)
+ Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing
failure as if no usable OCSP URLs were present. (markt)
+ Fix: Make the processing of OCSP responses more robust. (markt)
+ Fix: Stricter OCSP handling when soft-fail is disabled. (markt)
+ Fix: Cleaner handling of AJP response headers which overflow the maximum
message size. (remm)
+ Fix: Small per performance optimisation. Don't waste cycles swallowing
an AJP response body when the connection is going to be closed. (markt)
+ Fix: OpenSSL support for CRLs when using OpenSSL trust with the server
key held in a Java key store. (markt)
+ Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding
header. (markt)
+ Fix: Ensure per request HTTP/2 bad request marker is cleared when the
request is recycled. (markt)
+ Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)
+ Fix: Revert earlier refactoring of HTTP/2 header field validation that
moved it earlier since the refactoring made correct handling of invalid
headers more difficult. (markt)
+ Fix: EL evaluation of some lambda expressions. (remm)
* WebSocket
+ Fix: an exception when an automatic Pong response races with the closing
of the WebSocket session. (moritzfl)
+ Fix: Harden the WebSocket client and use a SecureRandom when generating
the Sec-WebSocket-Key header. (markt)
+ Fix: Improve robustness of client handshakes. (remm)
+ Fix: Ensure that WebSocket write timeouts apply to the complete message
and are not lost if two writes have the same timeout. (markt)
+ Fix: Reduce CPU usage while sending WebSocket close message. (markt)
+ Fix: overly broad check that prevented request URIs containing literal {
and } characters from being mapped to WebSocket end points. (markt)
+ Fix: handling of WebSocket messages with compressed payloads using per-
message-deflate that have one or more non-final blocks where the BFINAL
bit is set. (markt)
+ Fix: handling of per-message-deflate context takeover when receiving
compressed WebSocket messages. (markt)
* Web applications
+ Fix: Manager: Fix a potential concurrency issue when ordering sessions
prior to displaying a list of session. (markt)
+ Docs: Wrap the RewriteRule regular expression syntax reference on narrow
displays. Pull request #1044 by sainadh777. (markt)
* Other
+ Update: Easymock to 5.7.0. (markt)
+ Update: bnd to 7.4.0. (markt)
+ Update: Tomcat Native to 2.0.16. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji and
Ktamura.biz.80. (markt)
+ Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a
positive integer. Zero or negative values previously caused an infinite
loop or a NegativeArraySizeException during session state transfer. Pull
request #1042 provided by lihongyi87. (markt)
+ Fix: Improve robustness of cloud membership providers if an error occurs
fetching members. (remm)
* jdbc-pool
+ Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to
getConnection(String,String) rather than getConnection(). (markt)
+ Add: Log a warning if an attempt is made to obtain a connection with
credentials when alternateUsernameAllowed is set to false. (markt)
+ Fix: Ensure StatementCache interceptor resets properties of cached
statements between uses. (mark)
Changes for tomcat11:
- Update to Tomcat 11.0.26
+ Fix: Improve the handling of AsyncContext.dispatch() when the Context
attribute dispatchersUseEncodedPaths is set to false since the
application has no control over the path used for the
AsyncContext.dispatch(). Prior to this fix, paths containing literal '?'
characters were truncated. (markt)
+ Fix: Ensure that capture groups from a RewriteCond always reflect the
result of the current request. (markt)
+ Fix: When a PersistentManager needs to reduce the number of active
sessions, swap out the least recently used eligible sessions first. Pull
request #1045 provided by sainadh777. (markt)
+ Fix: Align web.xml logging output with the new Context attribute
urlPatternsProvidedInDecodedForm. (markt)
+ Fix: Improve robustness of DIGEST authentication to system clock jumps.
(markt)
+ Add: Support multiple protocol header values (treat as a single merged
header value) in the RemoteIpFilter and RemoteIpValve. (markt)
+ Fix: potential concurrency issues when loading/saving sessions from/to a
session store. Custom Store implementations that do not extend StoreBase
must implement the new getSessionStoreLock() method of the Store
interface to ensure concurrency protection. The default method
implementation provided only provides the pre-fix functionality. (markt)
+ Fix: Ensure that PersistentManager implementations that extend
PersistentManagerBase do not swap out sessions that are associated with
a request that is currently being processed. This includes not swapping
out a session unless the session was created when activity tracking was
enabled. (markt)
+ Fix: Ensure namespace attributes are XML escaped in WebDAV responses.
+ Fix: Resolve null or missing rewrite substitutions as an empty string,
to align with the mod_rewrite behavior. (remm)
+ Add: a best efforts protection in the CrawlerSessionManagerValve against
crawlers being associated with an authenticated session. (markt)
+ Fix: Clarify the meaning of various RewriteValve server variables and
explicitly use the canonical context path for the CONTEXT_PATH server
variable. (markt)
+ Fix: storeconfig not saving the path when a context is saved in
server.xml. (remm)
+ Fix: WAR URLConnection should propagate use of caching. (remm)
+ Fix: Ensure resources are evicted from the static resource cache in the
correct order. (markt)
+ Fix: When Jakarta Authentication is configured for a web application,
cache the ServerAuthConfig in the Authenticator valve. This ensures web
application specific settings are cached on a per web application basis.
+ Fix: 70203: Fix RegistrationListener notifications in Jakarta
Authentication implementation. (markt)
+ Fix: Handle CGI scripts that write excessively to stdout after setting
an HTTP error status code. (schultz)
+ Fix: Require the request to the login action during FORM authentication
to be made using HTTP POST. (markt)
+ Fix: 70208: Make URL encoding more robust. Based on pull request #1065
by Chenjp. (markt)
* Coyote
+ Fix: parsing of client certificates that specify more than one OCSP
responder for configurations that use OpenSSL-FFM. (markt)
+ Fix: xreflection generated code stack overflow issue. (remm)
+ Fix: Align xreflection better with IntrospectionUtils. (remm)
+ Fix: In HTTP/2 after half closed (remote), any unexpected frame should
be a stream error. (remm)
+ Fix: incorrect initial window size calculation when upgrading to HTTP/2.
(remm)
+ Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)
+ Fix: Only try and load the native library from the CATALINA_HOME system
property when the property is set. (markt)
+ Fix: max connections enforcement after an enpoint resume. (remm)
+ Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)
+ Add: length validation for ALPN protocol names. (markt)
+ Fix: Make FFM certificate verification more robust. (markt)
+ Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing
failure as if no usable OCSP URLs were present. (markt)
+ Fix: Make the processing of OCSP responses more robust. (markt)
+ Fix: Stricter OCSP handling when soft-fail is disabled. (markt)
+ Fix: Cleaner handling of AJP response headers which overflow the maximum
message size. (remm)
+ Fix: Small per performance optimisation. Don't waste cycles swallowing
an AJP response body when the connection is going to be closed. (markt)
+ Fix: OpenSSL support for CRLs when using OpenSSL trust with the server
key held in a Java key store. (markt)
+ Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding
header. (markt)
+ Fix: Ensure per request HTTP/2 bad request marker is cleared when the
request is recycled. (markt)
+ Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)
+ Fix: Revert earlier refactoring of HTTP/2 header field validation that
moved it earlier since the refactoring made correct handling of invalid
headers more difficult. (markt)
+ Fix: EL evaluation of some lambda expressions. (remm)
* WebSocket
+ Fix: an exception when an automatic Pong response races with the closing
of the WebSocket session. (moritzfl)
+ Fix: Harden the WebSocket client and use a SecureRandom when generating
the Sec-WebSocket-Key header. (markt)
+ Fix: Improve robustness of client handshakes. (remm)
+ Fix: Ensure that WebSocket write timeouts apply to the complete message
and are not lost if two writes have the same timeout. (markt)
+ Fix: Reduce CPU usage while sending WebSocket close message. (markt)
+ Fix: overly broad check that prevented request URIs containing literal {
and } characters from being mapped to WebSocket end points. (markt)
+ Fix: handling of WebSocket messages with compressed payloads using per-
message-deflate that have one or more non-final blocks where the BFINAL
bit is set. (markt)
+ Fix: handling of per-message-deflate context takeover when receiving
compressed WebSocket messages. (markt)
* Web applications
+ Fix: Manager: Fix a potential concurrency issue when ordering sessions
prior to displaying a list of session. (markt)
+ Docs: Wrap the RewriteRule regular expression syntax reference on narrow
displays. Pull request #1044 by sainadh777. (markt)
* Other
+ Update: Easymock to 5.7.0. (markt)
+ Update: bnd to 7.4.0. (markt)
+ Update: Tomcat Native to 2.0.16. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji and
Ktamura.biz.80. (markt)
+ Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a
positive integer. Zero or negative values previously caused an infinite
loop or a NegativeArraySizeException during session state transfer. Pull
request #1042 provided by lihongyi87. (markt)
+ Fix: Improve robustness of cloud membership providers if an error occurs
fetching members. (remm)
* jdbc-pool
+ Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to
getConnection(String,String) rather than getConnection(). (markt)
+ Add: Log a warning if an attempt is made to obtain a connection with
credentials when alternateUsernameAllowed is set to false. (markt)
+ Fix: Ensure StatementCache interceptor resets properties of cached
statements between uses. (mark)
Changes for tomcat:
- Update to Tomcat 9.0.122
+ Fix: Improve the handling of AsyncContext.dispatch() when the Context
attribute dispatchersUseEncodedPaths is set to false since the
application has no control over the path used for the
AsyncContext.dispatch(). Prior to this fix, paths containing literal '?'
characters were truncated. (markt)
+ Fix: Ensure that capture groups from a RewriteCond always reflect the
result of the current request. (markt)
+ Fix: When a PersistentManager needs to reduce the number of active
sessions, swap out the least recently used eligible sessions first. Pull
request #1045 provided by sainadh777. (markt)
+ Fix: Align web.xml logging output with the new Context attribute
urlPatternsProvidedInDecodedForm. (markt)
+ Fix: Improve robustness of DIGEST authentication to system clock jumps.
(markt)
+ Add: Support multiple protocol header values (treat as a single merged
header value) in the RemoteIpFilter and RemoteIpValve. (markt)
+ Fix: potential concurrency issues when loading/saving sessions from/to a
session store. Custom Store implementations that do not extend StoreBase
must implement the new getSessionStoreLock() method of the Store
interface to ensure concurrency protection. The default method
implementation provided only provides the pre-fix functionality. (markt)
+ Fix: Ensure that PersistentManager implementations that extend
PersistentManagerBase do not swap out sessions that are associated with
a request that is currently being processed. As a result, it is now a
requirement that the system property
org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to
true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either
minIdleSwap or maxIdleSwap are configured. (markt)
* Coyote
+ Fix: xreflection generated code stack overflow issue. (remm)
+ Fix: Align xreflection better with IntrospectionUtils. (remm)
+ Fix: In HTTP/2 after half closed (remote), any unexpected frame should
be a stream error. (remm)
+ Fix: incorrect initial window size calculation when upgrading to HTTP/2.
(remm)
+ Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)
+ Fix: Only try and load the native library from the CATALINA_HOME system
property when the property is set. (markt)
+ Fix: max connections enforcement after an enpoint resume. (remm)
+ Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)
+ Add: length validation for ALPN protocol names. (markt)
+ Fix: Make FFM certificate verification more robust. (markt)
+ Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing
failure as if no usable OCSP URLs were present. (markt)
+ Fix: Make the processing of OCSP responses more robust. (markt)
+ Fix: Stricter OCSP handling when soft-fail is disabled. (markt)
+ Fix: Cleaner handling of AJP response headers which overflow the maximum
message size. (remm)
+ Fix: Small per performance optimisation. Don't waste cycles swallowing
an AJP response body when the connection is going to be closed. (markt)
+ Fix: OpenSSL support for CRLs when using OpenSSL trust with the server
key held in a Java key store. (markt)
+ Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding
header. (markt)
+ Fix: Ensure per request HTTP/2 bad request marker is cleared when the
request is recycled. (markt)
+ Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)
+ Fix: Revert earlier refactoring of HTTP/2 header field validation that
moved it earlier since the refactoring made correct handling of invalid
headers more difficult. (markt)
+ Fix: EL evaluation of some lambda expressions. (remm)
* WebSocket
+ Fix: an exception when an automatic Pong response races with the closing
of the WebSocket session. (moritzfl)
+ Fix: Harden the WebSocket client and use a SecureRandom when generating
the Sec-WebSocket-Key header. (markt)
+ Fix: Improve robustness of client handshakes. (remm)
+ Fix: Ensure that WebSocket write timeouts apply to the complete message
and are not lost if two writes have the same timeout. (markt)
+ Fix: Reduce CPU usage while sending WebSocket close message. (markt)
+ Fix: overly broad check that prevented request URIs containing literal {
and } characters from being mapped to WebSocket end points. (markt)
+ Fix: handling of WebSocket messages with compressed payloads using per-
message-deflate that have one or more non-final blocks where the BFINAL
bit is set. (markt)
+ Fix: handling of per-message-deflate context takeover when receiving
compressed WebSocket messages. (markt)
* Web applications
+ Fix: Manager: Fix a potential concurrency issue when ordering sessions
prior to displaying a list of session. (markt)
+ Docs: Wrap the RewriteRule regular expression syntax reference on narrow
displays. Pull request #1044 by sainadh777. (markt)
* Other
+ Update: Easymock to 5.7.0. (markt)
+ Update: bnd to 7.4.0. (markt)
+ Update: Tomcat Native to 1.3.9. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji and
Ktamura.biz.80. (markt)
+ Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a
positive integer. Zero or negative values previously caused an infinite
loop or a NegativeArraySizeException during session state transfer. Pull
request #1042 provided by lihongyi87. (markt)
+ Fix: Improve robustness of cloud membership providers if an error occurs
fetching members. (remm)
* jdbc-pool
+ Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to
getConnection(String,String) rather than getConnection(). (markt)
+ Add: Log a warning if an attempt is made to obtain a connection with
credentials when alternateUsernameAllowed is set to false. (markt)
+ Fix: Ensure StatementCache interceptor resets properties of cached
statements between uses. (mark)CVSSUnscoredInsufficient evidenceSUSE-SU-2026:23710-1SUSE Linux Enterprisesuse · tomcat11&distro=SUSE Linux Enterprise Server 16.0 +1 moresuse tomcat11&distro=SUSE Linux Enterprise Server 16.0Security update for tomcat11
This update for tomcat11 fixes the following issues:
- CVE-2026-65182: Bypass longest prefix security constraint (bsc#1276893).
- CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets (bsc#1276894).
- CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete (bsc#1276895).
- CVE-2026-65905: Limited replay attack possible with DIGEST authentication (bsc#1276896).
- CVE-2026-65927: RewriteValve [N] restarts at the second rule and may bypass access control (bsc#1276897).
- CVE-2026-66299: memory exhaustion via maliciously slow clients due to the WebSocket chat example providing an
unbounded buffer for undelivered messages (bsc#1273150).
- CVE-2026-66422: Servlet role references can bypass declarative role constraints (bsc#1276898).
- CVE-2026-68525: Redirect after FORM auth may bypass method specific constraints (bsc#1276899).
- CVE-2026-68569: Principal lookup can fail open in some cases (bsc#1276900).
- CVE-2026-68763: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (bsc#1276901).
- CVE-2026-73180: Authenticated WebSocket session survives end of HTTP session (bsc#1276902).
Changes for tomcat11:
- Update to Tomcat 11.0.25
* Catalina
+ Fix: Ensure that a login-config conflict when merging web.xml fragments
triggers a deployment failure. (markt)
+ Code: Remove unnecessary calls to String.intern() in the parsing of
configuration files. (markt)
+ Fix: Extend sessionAttributeValueClassNameFilter to include filtering of
dynamic proxy interface classes. (markt)
+ Fix: Attempt to use rollback when persisting user data to the
DataSourceUserDatabase fails and improve error reporting. (remm)
+ Fix: 70143: Handle InvalidFileNameException when parsing parts to
rethrow it as an IllegalStateException as mandated by the Servlet
specification. (remm)
+ Fix: Add missing reason to the JsonErrorReportValve. (remm)
+ Fix: evaluation of the N and C flags for rewrite rules. (remm)
+ Fix: qsd flag should always discard the original query string when
rewriting. (remm)
+ Fix: Add appropriate escaping for context path, current directory name
and parent directory name for directory listings produced by the default
servlet. Ensure XML escaping is used with XML output. (markt)
+ Fix: When processing certificate subject names and issuer names within
RewriteValve rules, always use the RFC 2253 format name. (markt)
+ Fix: the incorrect rejection of requests using digest authentication
when the client provided nonce count is at the upper boundary of the
window (markt).
+ Update: Separate the Context role mapping from the Servlet specification
security-role-ref. (remm)
+ Fix: Handle the case where the JNDIRealm is configured to perform role
searches with userRoleAttribute but the attribute is not available or
not configured for the current user. (markt)
+ Fix: Improve handling of session attribute addition concurrent with
session expiration. An application will now either see a successful
addition followed by expiration or the addition will not succeed. It is
no longer possible for the session to expire and the addition to
succeed. This is of particular not for attributes that implement
HttpSessionBindingListener. (markt)
+ Fix: Add a new attribute to the Context,
urlPatternsProvidedInDecodedForm. This attribute controls whether URLs
and URL patterns provided in the deployment descriptor (web.xml),
annotations and/or their programmatic equivalents are treated as being
provided in URL-encoded form (i.e. using %nn encoding) or in decoded
form. The Servlet specification requires that they are provided in
decoded form. However, Tomcat has historically treated them as if they
are provided in encoded form. In Tomcat 12, they will always be treated
as if they are provided in decoded form. This setting enables migration
from encoded form to decoded form on an application by application
basis. This attribute will be removed in Tomcat 12 where it will
effectively be hard-coded to true. (markt)
+ Fix: Ensure the security constraint with the longest matching path is
selected when more than one constraint matches the request path. (markt)
+ Fix: If the request saved by FORM authentication uses a method other
than GET, ensure that the security constraints are re-assessed after the
saved request is restored and before it is processed. Custom
Authenticator implementations that extend FormAuthenticator and override
doAuthenticate() and/or restoreRequest() will require modification.
(markt)
+ Fix: Various improvements to the DataSourceRealm. A failure to connect
to the database or an exception during either user or role lookup will
now result in an authentication failure rather than a partially
populated Principal. For CLIENT-CERT and SPNEGO authentication, the user
must exist in the database for authentication to succeed. (markt)
* Coyote
+ Update: Add utility AutoCloseable URLConnection wrapper, and use it to
cleanup existing code patterns. (remm/markt)
+ Fix: When processing an HTTP upgrade from HTTP/1.1 to HTTP/2, ensure
that all the HTTP/1.1 data has been processed before switching
protocols. (markt)
+ Fix: Require every HTTP/2 request to provide an authority (either an
:authority pseudo header or a Host header). (markt)
+ Fix: Register the use of an HTTP/2 stream identifier earlier so that
there is no possibility of a re-used stream identifier being accepted,
regardless of how early in the HEADERS frame processing an error is
detected. (markt)
+ Add: new attributes (unixDomainSocketParentPermissions and
unixDomainSocketParentOwner) to the NIO connector to provide additional
control over the security of Unix Domain Sockets. Additional checks
(enabled by default) have also been added for the directory where the
Unix Domain Socket will be created.(markt)
+ Fix: an allocation leak in the HTTP/2 backlog tracking when a stream is
reset. (markt)
* Jasper
+ Fix: Ensure internal state is reset before re-using ELParser. (markt)
* WebSocket
+ Add: a limit (defaults to 8KB) on the size of the HTTP response headers
accepted during a WebSocket HTTP upgrade. This is configured via the
org.apache.tomcat.websocket.MAX_HTTP_RESPONSE_HEADER_BYTES user
property. (markt)
+ Fix: Improve URI template matching for WebSocket end points. Trailing
slashes are now significant both for template definitions and URIs
considered for potential matches to those URIs. Note that this means if
a URI template ends in a variable without a trailing slash, that
variable might be expanded to the empty string. (markt)
+ Fix: Account for session ID changes when tracking WebSocket connections
for closure because they were created under an authenticated HTTP
session that has since ended. (markt)
* Web applications
+ Fix: 70160: Correct various references to the Servlet specification to
use version 6.1. (markt)
+ Fix: Documentation: Better sample httpd configuration for use with
SSLValve and add a note that the exact configuration required will
depend on the overall httpd configuration. (markt)
+ Fix: Examples: Limit the buffering of messages in the WebSocket chat
example to prevent a malicious client triggering excessive memory usage
that could lead to a DoS. (markt)
+ Fix: Documentation: Expand the description of the %S (session ID) access
log pattern token. (markt)
+ Fix: Manager: Use reflection to load clustering classes in
sessionsList.jsp so the sessions list page renders correctly when
clustering JARs are not present. (csutherl)
* Other
+ Update: Maven Resolver Ant Tasks to 1.6.1. (rjung)
+ Update: Objenesis to 3.6. (markt)
+ Update: JSign to 7.5. (markt)
+ Update: Bouncy Castle to 1.85. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
* Cluster
+ Add: Change the default encryptionAlgorithm for the EncryptInterceptor
to AES/GCM/NoPadding. This is a breaking change for the
EncryptInterceptor. (markt)
+ Add: Expand the documentation for the EncryptInterceptor to be more
explicit regarding the security weaknesses of some supported algorithms.
Also explicitly state that the replay protection is only effective for
non-malleable algorithms. (markt)
+ Add: Expand the Javadoc for the DNSMembershipProvider in particular
explaining its behaviour and providing configuration advice if control
more over cluster membership is required. (markt)
* jdbc-pool
+ Fix: 70164: Correct the documentation for the testOnBorrow attribute.
Pull request #1033 provided by Kohei Tamura. (markt)CVSSUnscoredInsufficient evidenceSUSE-SU-2026:23691-1SUSE Linux Enterprisesuse · tomcat11&distro=SUSE Linux Enterprise Server 16.0 +1 moresuse tomcat11&distro=SUSE Linux Enterprise Server 16.0Security update for tomcat11
This update for tomcat11 fixes the following issues:
- CVE-2026-65182: Bypass longest prefix security constraint (bsc#1276893).
- CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets (bsc#1276894).
- CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete (bsc#1276895).
- CVE-2026-65905: Limited replay attack possible with DIGEST authentication (bsc#1276896).
- CVE-2026-65927: RewriteValve [N] restarts at the second rule and may bypass access control (bsc#1276897).
- CVE-2026-66299: memory exhaustion via maliciously slow clients due to the WebSocket chat example providing an
unbounded buffer for undelivered messages (bsc#1273150).
- CVE-2026-66422: Servlet role references can bypass declarative role constraints (bsc#1276898).
- CVE-2026-68525: Redirect after FORM auth may bypass method specific constraints (bsc#1276899).
- CVE-2026-68569: Principal lookup can fail open in some cases (bsc#1276900).
- CVE-2026-68763: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (bsc#1276901).
- CVE-2026-73180: Authenticated WebSocket session survives end of HTTP session (bsc#1276902).
Changes for tomcat11:
- Update to Tomcat 11.0.25
* Catalina
+ Fix: Ensure that a login-config conflict when merging web.xml fragments
triggers a deployment failure. (markt)
+ Code: Remove unnecessary calls to String.intern() in the parsing of
configuration files. (markt)
+ Fix: Extend sessionAttributeValueClassNameFilter to include filtering of
dynamic proxy interface classes. (markt)
+ Fix: Attempt to use rollback when persisting user data to the
DataSourceUserDatabase fails and improve error reporting. (remm)
+ Fix: 70143: Handle InvalidFileNameException when parsing parts to
rethrow it as an IllegalStateException as mandated by the Servlet
specification. (remm)
+ Fix: Add missing reason to the JsonErrorReportValve. (remm)
+ Fix: evaluation of the N and C flags for rewrite rules. (remm)
+ Fix: qsd flag should always discard the original query string when
rewriting. (remm)
+ Fix: Add appropriate escaping for context path, current directory name
and parent directory name for directory listings produced by the default
servlet. Ensure XML escaping is used with XML output. (markt)
+ Fix: When processing certificate subject names and issuer names within
RewriteValve rules, always use the RFC 2253 format name. (markt)
+ Fix: the incorrect rejection of requests using digest authentication
when the client provided nonce count is at the upper boundary of the
window (markt).
+ Update: Separate the Context role mapping from the Servlet specification
security-role-ref. (remm)
+ Fix: Handle the case where the JNDIRealm is configured to perform role
searches with userRoleAttribute but the attribute is not available or
not configured for the current user. (markt)
+ Fix: Improve handling of session attribute addition concurrent with
session expiration. An application will now either see a successful
addition followed by expiration or the addition will not succeed. It is
no longer possible for the session to expire and the addition to
succeed. This is of particular not for attributes that implement
HttpSessionBindingListener. (markt)
+ Fix: Add a new attribute to the Context,
urlPatternsProvidedInDecodedForm. This attribute controls whether URLs
and URL patterns provided in the deployment descriptor (web.xml),
annotations and/or their programmatic equivalents are treated as being
provided in URL-encoded form (i.e. using %nn encoding) or in decoded
form. The Servlet specification requires that they are provided in
decoded form. However, Tomcat has historically treated them as if they
are provided in encoded form. In Tomcat 12, they will always be treated
as if they are provided in decoded form. This setting enables migration
from encoded form to decoded form on an application by application
basis. This attribute will be removed in Tomcat 12 where it will
effectively be hard-coded to true. (markt)
+ Fix: Ensure the security constraint with the longest matching path is
selected when more than one constraint matches the request path. (markt)
+ Fix: If the request saved by FORM authentication uses a method other
than GET, ensure that the security constraints are re-assessed after the
saved request is restored and before it is processed. Custom
Authenticator implementations that extend FormAuthenticator and override
doAuthenticate() and/or restoreRequest() will require modification.
(markt)
+ Fix: Various improvements to the DataSourceRealm. A failure to connect
to the database or an exception during either user or role lookup will
now result in an authentication failure rather than a partially
populated Principal. For CLIENT-CERT and SPNEGO authentication, the user
must exist in the database for authentication to succeed. (markt)
* Coyote
+ Update: Add utility AutoCloseable URLConnection wrapper, and use it to
cleanup existing code patterns. (remm/markt)
+ Fix: When processing an HTTP upgrade from HTTP/1.1 to HTTP/2, ensure
that all the HTTP/1.1 data has been processed before switching
protocols. (markt)
+ Fix: Require every HTTP/2 request to provide an authority (either an
:authority pseudo header or a Host header). (markt)
+ Fix: Register the use of an HTTP/2 stream identifier earlier so that
there is no possibility of a re-used stream identifier being accepted,
regardless of how early in the HEADERS frame processing an error is
detected. (markt)
+ Add: new attributes (unixDomainSocketParentPermissions and
unixDomainSocketParentOwner) to the NIO connector to provide additional
control over the security of Unix Domain Sockets. Additional checks
(enabled by default) have also been added for the directory where the
Unix Domain Socket will be created.(markt)
+ Fix: an allocation leak in the HTTP/2 backlog tracking when a stream is
reset. (markt)
* Jasper
+ Fix: Ensure internal state is reset before re-using ELParser. (markt)
* WebSocket
+ Add: a limit (defaults to 8KB) on the size of the HTTP response headers
accepted during a WebSocket HTTP upgrade. This is configured via the
org.apache.tomcat.websocket.MAX_HTTP_RESPONSE_HEADER_BYTES user
property. (markt)
+ Fix: Improve URI template matching for WebSocket end points. Trailing
slashes are now significant both for template definitions and URIs
considered for potential matches to those URIs. Note that this means if
a URI template ends in a variable without a trailing slash, that
variable might be expanded to the empty string. (markt)
+ Fix: Account for session ID changes when tracking WebSocket connections
for closure because they were created under an authenticated HTTP
session that has since ended. (markt)
* Web applications
+ Fix: 70160: Correct various references to the Servlet specification to
use version 6.1. (markt)
+ Fix: Documentation: Better sample httpd configuration for use with
SSLValve and add a note that the exact configuration required will
depend on the overall httpd configuration. (markt)
+ Fix: Examples: Limit the buffering of messages in the WebSocket chat
example to prevent a malicious client triggering excessive memory usage
that could lead to a DoS. (markt)
+ Fix: Documentation: Expand the description of the %S (session ID) access
log pattern token. (markt)
+ Fix: Manager: Use reflection to load clustering classes in
sessionsList.jsp so the sessions list page renders correctly when
clustering JARs are not present. (csutherl)
* Other
+ Update: Maven Resolver Ant Tasks to 1.6.1. (rjung)
+ Update: Objenesis to 3.6. (markt)
+ Update: JSign to 7.5. (markt)
+ Update: Bouncy Castle to 1.85. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
* Cluster
+ Add: Change the default encryptionAlgorithm for the EncryptInterceptor
to AES/GCM/NoPadding. This is a breaking change for the
EncryptInterceptor. (markt)
+ Add: Expand the documentation for the EncryptInterceptor to be more
explicit regarding the security weaknesses of some supported algorithms.
Also explicitly state that the replay protection is only effective for
non-malleable algorithms. (markt)
+ Add: Expand the Javadoc for the DNSMembershipProvider in particular
explaining its behaviour and providing configuration advice if control
more over cluster membership is required. (markt)
* jdbc-pool
+ Fix: 70164: Correct the documentation for the testOnBorrow attribute.
Pull request #1033 provided by Kohei Tamura. (markt)CVSSUnscoredInsufficient evidenceSUSE-SU-2026:22648-1SUSE Linux Enterprisesuse · tomcat11&distro=SUSE Linux Enterprise Server 16.0 +1 moresuse tomcat11&distro=SUSE Linux Enterprise Server 16.0Security update for tomcat11
This update for tomcat11 fixes the following issues
Update to Tomcat 11.0.23.
Security issues fixed:
- CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
- CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be
skipped if the first condition in an OR chain matched (bsc#1269910).
- CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
- CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints
to not be included when the effective web.xml was logged (bsc#1269909).
- CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster
component (bsc#1269908).
- CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any
method or method omission configured as part of the constraint (bsc#1269907).
Other updates and bugfixes:
- Upgrade libtcnative to v2 (bsc#1232390)
- Tomcat 11.0.23:
* Catalina
+ Add: Add support for literal '%' characters in access log output. Based on
pull request #1002 by Fabian Hahn. (markt)
+ Fix: Lower the log level to debug when OpenSSL initialization fails in
OpenSSLLifecycleListener to avoid stack traces when libssl.so is not
present and to align the behavior of the isAvailable() check with the
AprLifecycleListener and gracefully fail when natives are not present.
(csutherl)
+ Fix: 70038: Cookie.clone() should also clone the internal attribute map.
(markt)
+ Code: Remove unnecessary code from the SSI processing engine that was
duplicating some of the normalisation checks. (markt)
+ Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
+ Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
(remm)
+ Fix: Incorrect session average life calculation. (remm)
+ Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
(remm)
+ Fix: Avoid any init parameter updates when conflicts are found for
filters, similar to what is done for servlets, as required by the servlet
specification. (remm)
+ Fix: Fix container event cleanups in some edge cases. (remm)
+ Fix: Check for last-modified header in ExpiresFilter when a servlet uses
addDateHeader to avoid wrongly considering it has been set. (remm)
+ Fix: Fix hour unit used by ExpiresFilter. (remm)
+ Fix: Remove exception swallowing in DataSourceStore to align it with
FileStore and avoid session loss on errors. (remm)
+ Fix: Add support for single-quote escaped literal as well as quoted
literals in DateFormatCache. (schultz)
+ Fix: On JAAS logout, clear out role principals on the subject that were
added on commit, as recommended by the JAAS specification. (remm)
+ Fix: MemoryRealm should not add a dummy role when none is specified in the
configuration. (remm)
+ Fix: DataSourceUserDatabase should return a null principal on a non
existing user. (remm)
+ Fix: Fix shared lock expiration in WebDAV. (remm)
+ Fix: Inaccurate session exipration statistics when using the persistent
manager. (remm)
+ Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
+ Fix: Mixup of WrapperListener and WrapperLifecycle elements in
storeconfig. (remm)
+ Fix: Incorrect processing of modified users in DataSourceUserDatabase.
(remm)
+ Update: Clarify behavior in the UserDatabase for user, role and group
creation that it does not immediately override existing elements. Removal
(or update) needs to be used instead. (remm)
+ Fix: 70049: Align the web application class loader with parent class
loaders and swallow any errors caused by invalid paths when looking up
resources and behave as if the resources were not found in that case.
(markt)
+ Fix: Improve validation of Range and Content-Range parsers so invalid
ranges trigger a 4xx response rather than a 500 response. Pull request
#1012 provided by Sahana Surendra Bogar. (markt)
+ Fix: Fix connection leak in ProxyErrorReportValve. (remm)
+ Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off
rather than true or false to align with httpd. (markt)
+ Fix: Reset the encoding used for query string parameters between requests
in case an application changed the encoding in a previous request. (markt)
+ Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce
to URLs that are known not to require it. (markt)
+ Fix: Fix SSO cookie partitioned configuration. (remm)
+ Fix: Fix CombinedRealm isAvailable, it allows authentication if at least
one sub realm is available. (remm)
+ Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
(markt)
+ Fix: Improve the detection of cross-context dispatches when using a
RequestDispatcher. (markt)
+ Fix: Fix various instances of double decoding of URL patterns configured
either programmatically or in web.xml. (remm/markt)
+ Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,
which follows a purely sequential evaluation strategy. (remm)
+ Fix: Update default web.xml version to match supported Servlet
specification version. (markt)
+ Fix: Change the default for the useRedirect attribute of the
ProxyErrorReportValve from true to false. (markt)
+ Add: Add support for the showReport attribute in JsonErrorReportValve and
ProxyErrorReportValve. When set to false, detailed error information
(message, description, stack trace) is suppressed from error responses.
(dsoumis)
+ Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is
removed but catalina-ha.jar is present and the Cluster element is enabled
in server.xml. Cluster digester rules are now fully conditional on both
JARs being available. (dsoumis)
+ Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)
+ Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list
of reserved prefixes for SSI variables and request attributes. (markt)
+ Fix: Missing URL decoding when processing addMapping on a Servlet
registration. (remm)
+ Fix: The Timeout WebDAV header allows comma separated values (according to
the examples in the RFC). Use the first acceptable value. (remm)
+ Fix: Fix various issues when logging the effective web.xml for a web
application. Empty sections are no longer logged. Special roles and empty
authorisation constraints are included. All session cookie attributes are
included. (markt)
+ Fix: Expand the write lock for the save process in the MemoryUserDatabase
to avoid concurrency issues with the file save operations. (markt)
+ Fix: Ensure atomic session persistence in FileStore. Based on pull request
#1016 by sahvx655-wq. (markt)
+ Fix: Do not ignore methods configured on security constraints that map to
the default servlet. (markt)
* Cluster
+ Fix: Expand wording and increase visibility of log message when cloud
membership is configured without a trust store as all certificates will be
trusted in this configuration. (markt)
+ Fix: Ensure listeners are correctly added and removed when configuring the
channel coordinator. (markt)
+ Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)
+ Fix: Fix some concurrency issues in OrderInterceptor. (markt)
+ Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)
+ Fix: Fix concurrency issues generating MD5 digests in the
CloudMembershipProvider implementations. (markt)
+ Add: Add replay protection to the EncryptInterceptor. This us a breaking
change for the EncryptInterceptor.(markt)
* Coyote
+ Add: Log a suitable warning if an encrypted PEM file is detected using an
insecure form for encryption. (markt)
+ Fix: If TLS groups have been configured, use the configured groups rather
than using OpenSSL's default TLS groups when using Tomcat Native with
OpenSSL based connectors. (markt)
+ Fix: For HTTP/2, ensure that any in progress request body reads are
cancelled if the container resets the associated stream. This prevents
delays waiting for reads to time out when it is known that no more data
will be received. (markt)
+ Fix: Ensure that malformed HTTP/2 messages that should trigger a stream
reset do so, rather than triggered a connection close. (markt)
+ Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)
+ Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,
following refactor clean-up of header buffer. (remm)
+ Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)
+ Fix: Fix MessageByte.equals if called on a null MB. (remm)
+ Fix: Call the delegate key manager in JSSE to retrieve the server key.
(remm)
+ Fix: Avoid overflow scenarios in Asn1Parser. (remm)
+ Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that
allows the consistency check for the scheme provided by the user agent to
be bypassed. (markt)
+ Fix: isTrailerFieldsReady was always returning true. (remm)
+ Fix: Align OpenSSL/Panama TLS implementation with other implementations
and throw an exception if there is an error loading the provided CRL(s).
(markt)
+ Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if
@STRENGTH was encountered, ignoring any subsequent expressions. (markt)
+ Fix: Handle the case where the HTTP/2 payload length is insufficient for
the mandatory data required by the flags set in the header. (markt)
+ Fix: 70102: Correct expected size of ticket keys when calling
setSessionTicketKeys with an FFM connector. (markt)
+ Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken
by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)
+ Fix: When processing an OpenSSL cipher specification, fully align the
order of the resulting ciphers with the order produced by OpenSSL. (markt)
+ Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
(schultz)
+ Update: Update both the minimum and recommended version for Tomcat Native
2.x to 2.0.15. (markt)
+ Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
* Jasper
+ Fix: Fix possible EL argument mismatch when it was set to null. (remm)
+ Fix: Fix thread safety of TagPluginManager. (remm)
+ Fix: Correctly use flush on JSP include. (remm)
* Web applications
+ Add: Manager: Add checks to ensure that any uploaded files are uploaded to
the expected location. (markt)
+ Add: Manager: Add checks to ensure that the requested context path for a
deployed WAR, directory or descriptor file is valid. (markt)
+ Add: Documentation: Expand the description of some of the attributes of
the CrawlerSessionManagerValve. (markt)
+ Fix: Documentation: Clearer description and correct documented default for
ocspSoftFail. (markt)
+ Fix: Fix double escaping in the context names for the JSON mode of the
manager servlet. (remm)
+ Fix: Manager: Ensure automatic deployment does not trigger an undeployment
during a Manager triggered web application reload. (markt)
+ Fix: Documentation: Provide better documentation for the scheme and secure
attributes of a Connector. (markt)
* Websocket
+ Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)
+ Fix: Trigger standard WebSocket error handling if a call to
Endpoint.onOpen() fails for a programmatic endpoint. (markt)
+ Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a
programmatic endpoint. Test case provided by uabdur. (markt)
+ Fix: If a client presents invalid parameters when negotiating a WebSocket
extension, decline the negotiation offer that includes the invalid
parameters rather than failing the connection. Pull request #1019 provided
by sahvx655-wq. (markt)
* Other
+ Fix: Use per connection authenticator when executing an Ant task.
(remm/markt)
+ Update: Update Commons Daemon to 1.6.1. (markt)
+ Fix: Prevent duplicate log messages when clustering JARs are not present
on startup. (csutherl)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.12. (markt)
+ Update: Update Tomcat Native to 2.0.15. (markt)CVSSUnscoredInsufficient evidenceSUSE-SU-2026:22196-1SUSE Linux Enterprisesuse · tomcat11&distro=SUSE Linux Enterprise Server 16.0 +1 moresuse tomcat11&distro=SUSE Linux Enterprise Server 16.0Security update for tomcat11
This update for tomcat11 fixes the following issues
Update to Tomcat 11.0.22:
- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).
Changes:
* Catalina
+ Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and
OpenSSL version information (both APR and FFM implementations), along with
version compatibility warnings and third-party library version
information. (csutherl)
+ Code: Refactor generation of the remote user element in the access log to
remove unnecessary code. (markt)
+ Fix: Fix a regression in the previous release that meant ?- could appear
in the access log rather than ? when the query string was present but
empty. (markt)
+ Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by
Mahmoud Alarby. (remm)
+ Fix: Align the escaping in ExtendedAccessLogValve with the other
AccessLogValve implementations. (markt)
+ Fix: 70000: fix duplication of special headers in the response after
commit, following fix for 69967. (remm)
+ Fix: Correct the handling of URIs mapped to a security constraint that
only specifies the special ** role for all authenticated users. Requests
without authentication were receiving 403 responses rather than 401
responses. (markt)
+ Fix: Fix a race condition in StandardContext.getServletContext() that
could cause the jakarta.servlet.context.tempdir attribute to be lost
during a context reload. Make the context field volatile and use locking
to ensure only one ApplicationContext instance is created. (dsoumis)
+ Fix: Update the Windows authentication (kerberos) documentation to reflect
that both Java and Windows are removing / have removed support for
RC4-HMAC. The guide now uses AES256-SHA1. (markt)
+ Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize
which limits the size of a WebDAV request body for LOCK and PROPFIND. The
default value is 4096 bytes. (markt)
+ Add: Add a new caseSensitive attribute to the LockOutRealm that controls
the manner in which user names are treated when making locking decisions.
The default is false, meaning user names are treated in a case insensitive
manner. (markt)
+ Fix: Correct the handling of invalid users with DIGEST authentication.
(markt)
+ Fix: Ensure RealmBase finds all matching extension based security
constraints. (markt)
* Coyote
+ Fix: Avoid various edge cases if Content-Length is set via
setHeader(String,String) or addHeader(String,String) with an invalid value
by always clearing the previous value whether the new value is valid or
not and ignoring any invalid new value. (markt)
+ Code: Refactor the calculation of the real index in the HPACK dynamic
header table implementation to reduce code duplication. (markt)
+ Fix: Fix various minor issues with some HTTP/2 stream error messages for
HTTP/2. (markt)
+ Fix: Consistently reject URIs containing NULL bytes when normalizing.
+ Fix: Fix a few minor memory leaks on error paths reading TLS keys and
certificates when using FFM. (markt)
+ Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC
after a stream reset. (markt)
+ Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields
not permitted in trailers. (markt)
+ Fix: Free private keys after use in FFM based connector configuration.
+ Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header
decoding that could result in a valid header triggering an unexpected
connection close. (markt)
+ Fix: Refactor HTTP/2 HPACK encoding so header field names are only
converted to lower case once during the encoding process. (markt)
+ Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend
validation to check for disallowed characters as well as upper case
characters. (markt)
+ Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)
+ Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent
with the use (or not) of TLS. (markt)
+ Fix: Correct the validation of pseudo headers and CONNECT requests to
align Tomcat's behaviour with RFC 9113, section 8.5. (markt)
+ Fix: Fix a potential integer overflow when allocating capacity from a
connection level window update to individual HTTP/2 streams. Based on #996
by Mike Tingey Jr. (markt)
+ Fix: Switch AJP secret comparison to a constant time algorithm. (markt)
* WebSocket
+ Fix: Fix the initial connection to a WebSocket end point where the
connection is made via a proxy that requires DIGEST authentication.
* Other
+ Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)
+ Add: Add warning when OpenSSL binary is not found. (csutherl)
+ Add: Add check for Tomcat Native library, and log warning when it's not
found to make it easier to see when it's not used by the suite. (csutherl)
+ Update: Update Byte Buddy to 1.18.8. (markt)
+ Update: Update Bouncy Castle to 1.84. (markt)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)CVSSUnscoredInsufficient evidenceSUSE-SU-2026:20926-1SUSE Linux Enterprisesuse · tomcat11&distro=SUSE Linux Enterprise Server 16.0 +1 moresuse tomcat11&distro=SUSE Linux Enterprise Server 16.0Security update for tomcat11
This update for tomcat11 fixes the following issues:
Update to Tomcat 11.0.18:
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
Changelog:
+ Fix: 69932: Fix request end access log pattern regression, which would log
the start time of the request instead. (remm)
+ Fix: 69623: Additional fix for the long standing regression that meant
that calls to ClassLoader.getResource().getContent() failed when made from
within a web application with resource caching enabled if the target
resource was packaged in a JAR file. (markt)
+ Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
+ Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
+ Update: Enable minimum and recommended Tomcat Native versions to be set
separately for Tomcat Native 1.x and 2.x. Update the minimum and
recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum
and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
+ Add: Add a new ssoReauthenticationMode to the Tomcat provided
Authenticators that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
+ Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
+ Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
+ Fix: Add log warnings for additional Host appBase suspicious values.
(remm)
+ Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
+ Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
+ Fix: Change the SSO reauthentication behaviour for SPNEGO authentication
so that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
+ Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential
NullPointerException. Identified by Coverity Scan. (markt)
+ Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
+ Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the
credential and salt are digested. By default, the current, non-RFC 3112
compliant, order of salt then credential will be used. This default will
change in Tomcat 12 to the RFC 3112 compliant order of credential then
salt. (markt)
* Cluster
+ Add: 62814: Document that human-readable names may be used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
+ Fix: Correct a regression introduced in 11.0.11 that broke some clustering
configurations. (markt)
* Coyote
+ Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown
that triggered a significant memory leak. Patch provided by Wes. (markt)
+ Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
+ Fix: Improve warnings when setting ciphers lists in the FFM code,
mirroring the tomcat-native changes. (remm)
+ Fix: 69910: Dereference TLS objects right after closing a socket to
improve memory efficiency. (remm)
+ Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the
other attributes. (markt)
+ Fix: Better warning message when OpenSSLConf configuration elements are
used with a JSSE TLS implementation. (markt)
+ Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
+ Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute
of an SSLHostConfig are now always ignored (previously they would be
ignored with OpenSSL implementations and used with JSSE implementations)
and a warning is logged that the cipher suite has been ignored. (markt)
+ Add: Add the ciphersuite attribute to SSLHostConfig to configure the
TLSv1.3 cipher suites. (markt)
+ Add: Add OCSP support to JSSE based TLS connectors and make the use of
OCSP configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those
performed by JSSE. (markt)
+ Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
+ Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
+ Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
+ Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
+ Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
+ Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The
attribute default value is true, enabling the matching. (remm)
+ Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
+ Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
+ Fix: Fix potential crash on shutdown when a Connector depends on the
Tomcat Native library. (markt)
+ Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
* Jasper
+ Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
+ Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
+ Fix: Fix populating the classpath with the webapp classloader
repositories. (remm)
+ Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
+ Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
+ Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
+ Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
+ Add: Documentation: Expand the documentation to better explain when OCSP
is supported and when it is not. (markt)
* Websocket
+ Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
* Other
+ Add: Add property "gpg.sign.files" to optionally disable release artefact
signing with GPG. (rjung)
+ Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
+ Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
+ Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
+ Update: Update Commons Daemon to 1.5.1. (markt)
+ Update: Update to the Eclipse JDT compiler 4.37. (markt)
+ Update: Update ByteBuddy to 1.18.3. (markt)
+ Update: Update UnboundID to 7.0.4. (markt)
+ Update: Update Checkstyle to 12.3.1. (markt)
+ Add: Improvements to French translations. (markt)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
+ Update: Update Tomcat Native to 2.0.12. (markt)
+ Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile=<name> to run specific test subsets without
using patterns directly. Profile patterns are defined in
test-profiles.properties. (csutherl)
+ Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.10. (markt)
+ Update: Update Commons Daemon to 1.5.0. (markt)
+ Update: Update Byte Buddy to 1.18.2. (markt)
+ Update: Update Checkstyle to 12.2.0. (markt)
+ Add: Improvements to Spanish translations provided by White Vogel. (markt)
+ Add: Improvements to French translations. (remm)
+ Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
+ Update: Update to Byte Buddy 1.17.8. (markt)
+ Update: Update to Checkstyle 12.1.1. (markt)
+ Update: Update to Jacoco 0.8.14. (markt)
+ Update: Update to SpotBugs 4.9.8. (markt)
+ Update: Update to JSign 7.4. (markt)
+ Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)CVSSUnscored