dev  

Messages by Date

• 2026/09/28 [UPDATE][SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas via dev
• 2026/09/28 [UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
• 2026/09/28 (tomcat) branch main updated: Typos remm
• 2026/09/27 [PR] Bump jakarta.tck:sigtest-maven-plugin from 2.6 to 2.7 [tomcat-tck] via GitHub
• 2026/09/27 [PR] Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 [tomcat-tck] via GitHub
• 2026/09/27 (tomcat-tck) branch dependabot/maven/jakarta.tck-sigtest-maven-plugin-2.7 created (now c5b40e3) github-bot
• 2026/09/27 (tomcat-tck) branch dependabot/maven/org.junit-junit-bom-6.1.3 created (now 8028a24) github-bot
• 2026/09/27 (tomcat-tck) branch dependabot/maven/org.slf4j-slf4j-simple-2.0.20 created (now 0d19279) github-bot
• 2026/09/27 [PR] Bump org.slf4j:slf4j-simple from 2.0.18 to 2.0.20 [tomcat-tck] via GitHub
• 2026/09/27 [PR] Bump org.junit:junit-bom from 6.1.0 to 6.1.3 [tomcat-tck] via GitHub
• 2026/09/27 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-install-plugin-3.2.0 created (now 476df0b) github-bot
• 2026/09/27 (tomcat-jakartaee-migration) branch dependabot/maven/org.apache-apache-40 deleted (was f69bb56) github-bot
• 2026/09/27 (tomcat-jakartaee-migration) branch main updated: Bump org.apache:apache from 39 to 40 remm
• 2026/09/27 Re: [PR] Bump org.apache:apache from 39 to 40 [tomcat-jakartaee-migration] via GitHub
• 2026/09/27 [Bug 69890] Update test-status for more clear output bugzilla
• 2026/09/27 (tomcat-jakartaee-migration) branch dependabot/maven/org.apache-apache-40 created (now f69bb56) github-bot
• 2026/09/27 [PR] Bump org.apache:apache from 39 to 40 [tomcat-jakartaee-migration] via GitHub
• 2026/09/27 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/27 [Bug 70249] New: EL in Tomcat 12-M1: NPE coerceToNumber() bugzilla
• 2026/09/27 Buildbot success in on tomcat-9.0.x buildbot
• 2026/09/27 Buildbot success in on tomcat-10.1.x buildbot
• 2026/09/27 (tomcat) branch 9.0.x updated: Fix possible corruption with HTTP/2 and large uploads remm
• 2026/09/27 (tomcat) branch 10.1.x updated: Fix possible corruption with HTTP/2 and large uploads remm
• 2026/09/27 (tomcat) branch 11.0.x updated: Fix possible corruption with HTTP/2 and large uploads remm
• 2026/09/27 Re: [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/27 Re: [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/27 (tomcat) branch main updated: Fix possible corruption with HTTP/2 and large uploads remm
• 2026/09/26 Re: [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/25 Re: [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/25 Buildbot failure in on tomcat-10.1.x buildbot
• 2026/09/25 Buildbot failure in on tomcat-11.0.x buildbot
• 2026/09/25 [PR] Fix data corruption in SocketBufferHandler.unReadReadBuffer() [tomcat] via GitHub
• 2026/09/25 (tomcat) branch 10.1.x updated: Update the internal fork of Apache Commons BCEL to 6.13.0 markt
• 2026/09/25 (tomcat) branch 9.0.x updated: Update the internal fork of Apache Commons BCEL to 6.13.0 markt
• 2026/09/25 (tomcat) branch 11.0.x updated: Update the internal fork of Apache Commons BCEL to 6.13.0 markt
• 2026/09/25 (tomcat) branch main updated: Update the internal fork of Apache Commons BCEL to 6.13.0 markt
• 2026/09/25 (tomcat) branch main updated: Fix checkstyle error markt
• 2026/09/25 (tomcat) branch main updated: Another round of documentation updates for clusters with TLS markt
• 2026/09/25 Re: TLS support for tribes (clustering) Mark Thomas
• 2026/09/25 (tomcat) branch main updated: Fixes for MembershipServiceBase with TLS-PSK markt
• 2026/09/25 (tomcat) branch main updated: Fix issue with some missing messages markt
• 2026/09/25 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/25 (tomcat) branch main updated: LibreSSL does not support PSK at all remm
• 2026/09/25 (tomcat) branch main updated: Hopefully the final check to fix to MacOS smoke test markt
• 2026/09/25 Re: (tomcat) branch main updated: Fix LibreSSL compatibility Rémy Maucherat
• 2026/09/25 (tomcat) branch main updated: Better fix for test failures on Java 21 and earlier markt
• 2026/09/25 (tomcat) branch main updated: Fix LibreSSL compatibility remm
• 2026/09/25 Re: (tomcat) branch main updated: Skip FFM tests if running on Java 21 or earlier Mark Thomas
• 2026/09/25 (tomcat) branch main updated: Add a note re LibreSSL markt
• 2026/09/25 (tomcat) branch main updated: Revert "Add OpenSSL support to the MacOS smoketest" markt
• 2026/09/25 Re: (tomcat) branch main updated: Add OpenSSL support to the MacOS smoketest Mark Thomas
• 2026/09/25 Re: (tomcat) branch main updated: Move SSL_in_init to compat Rémy Maucherat
• 2026/09/25 Re: (tomcat) branch main updated: Add OpenSSL support to the MacOS smoketest Rémy Maucherat
• 2026/09/25 (tomcat) branch main updated: Move SSL_in_init to compat remm
• 2026/09/25 (tomcat) branch main updated: Add OpenSSL support to the MacOS smoketest markt
• 2026/09/25 (tomcat) branch main updated: Skip FFM tests if running on Java 21 or earlier markt
• 2026/09/25 Re: [PR] Bring back OpenSSL 1.1.1 support [tomcat-native] via GitHub
• 2026/09/25 Re: [PR] Bring back OpenSSL 1.1.1 support [tomcat-native] via GitHub
• 2026/09/25 Re: [Bug 70244] SPAM SPAM SPAM SPAM Felix Schumacher
• 2026/09/24 [PR] Bring back OpenSSL 1.1.1 support [tomcat-native] via GitHub
• 2026/09/24 (tomcat) branch main updated: Expands tests markt
• 2026/09/24 (tomcat) 02/02: First pass at TLS 1.3 support markt
• 2026/09/24 (tomcat) 01/02: Align with Tomcat Native 1.2.x markt
• 2026/09/24 (tomcat) branch main updated (2db121ddce -> 1de7fac738) markt
• 2026/09/24 (tomcat-native) branch main updated: Further fix for TLS 1.3 PSK support markt
• 2026/09/24 (tomcat) branch main updated: And some more deprecation markt
• 2026/09/24 (tomcat) branch main updated: Additional deprecation markt
• 2026/09/24 (tomcat-native) branch main updated: Complete the PSK support with client-side TLS 1.3 markt
• 2026/09/24 [Bug 70248] New: Uploads fail over HTTP/2: Tomcat closes the connection with "payload is [16777215] bytes long but the maximum frame size is [16384]" bugzilla
• 2026/09/24 (tomcat) 02/03: Complete securePort support for DNS membership (untested) markt
• 2026/09/24 TLS support for tribes (clustering) Mark Thomas
• 2026/09/24 (tomcat) 01/03: Align naming markt
• 2026/09/24 (tomcat) 03/03: Update docs to recommend TLS rather than EncryptInterceptor markt
• 2026/09/24 (tomcat) branch main updated (85d7b3a067 -> bb4e829af0) markt
• 2026/09/24 (tomcat) branch main updated (a0c3ab5657 -> 85d7b3a067) markt
• 2026/09/24 (tomcat) 02/02: Fix various edge cases for secure only configurations markt
• 2026/09/24 (tomcat) 01/02: Better logging for secure vs non-secure cluster configuration markt
• 2026/09/23 (tomcat-maven-plugin) branch dependabot/maven/org.apache-apache-40 deleted (was f11a94b) github-bot
• 2026/09/23 (tomcat-maven-plugin) 01/01: Merge pull request #139 from apache/dependabot/maven/org.apache-apache-40 remm
• 2026/09/23 (tomcat-maven-plugin) branch trunk updated (9799978 -> e6b55d1) remm
• 2026/09/23 Re: [PR] Bump org.apache:apache from 38 to 40 [tomcat-maven-plugin] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6 deleted (was 9e5c162) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.6.0 markt
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.6.0 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6 updated (d57b77a -> 9e5c162) github-bot
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 [tomcat-tck] via GitHub
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 [tomcat-tck] via GitHub
• 2026/09/23 Re: [PR] Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.jboss.arquillian.container-arquillian-tomcat-embedded-10-1.2.5.Final deleted (was a16b248) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.jboss.arquillian.container:arquillian-tomcat-embedded-10 markt
• 2026/09/23 Re: [PR] Bump org.jboss.arquillian.container:arquillian-tomcat-embedded-10 from 1.2.4.Final to 1.2.5.Final [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.jboss.arquillian.container-arquillian-tomcat-embedded-10-1.2.5.Final updated (891ce31 -> a16b248) github-bot
• 2026/09/23 Re: [PR] Bump org.jboss.arquillian.container:arquillian-tomcat-embedded-10 from 1.2.4.Final to 1.2.5.Final [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.6 updated (9633c66 -> d57b77a) markt
• 2026/09/23 Re: [PR] Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.jacoco-jacoco-maven-plugin-0.8.15 deleted (was c244d94) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 markt
• 2026/09/23 (tomcat-tck) branch main updated: Bump org.junit:junit-bom from 6.0.3 to 6.1.0 markt
• 2026/09/23 Re: [PR] Bump org.junit:junit-bom from 6.0.3 to 6.1.0 [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/org.junit-junit-bom-6.1.0 deleted (was 6712131) github-bot
• 2026/09/23 Re: [PR] Bump arquillian.version from 1.10.1.Final to 1.10.2.Final [tomcat-tck] via GitHub
• 2026/09/23 (tomcat-tck) branch dependabot/maven/arquillian.version-1.10.2.Final deleted (was 0752955) github-bot
• 2026/09/23 (tomcat-tck) branch main updated: Bump arquillian.version from 1.10.1.Final to 1.10.2.Final markt
• 2026/09/23 Re: Coverity Issues Review Fatima Qaisar
• 2026/09/23 [SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas
• 2026/09/23 (tomcat-native) branch 1.3.x updated: Stop OCSP checks once a cert in the trust store is reached markt
• 2026/09/23 (tomcat-native) branch main updated: Stop OCSP checks once a cert in the trust store is reached markt
• 2026/09/23 [SECURITY] CVE-2026-86247 Apache Tomcat Native - Client certificate requirements can be down-graded Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86246 Apache Tomcat Native - Insecure OpenSSL options enabled Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86243 Apache Tomcat Native - DoS via TLS handshake Mark Thomas
• 2026/09/23 svn commit: r1938458 - in tomcat/site/trunk: docs xdocs markt
• 2026/09/23 [SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• 2026/09/23 [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
• 2026/09/23 svn commit: r1938456 - in tomcat/site/trunk: docs xdocs markt
• 2026/09/23 Re: (tomcat) 01/02: Implement TSL-PSK encryption for clustering Rémy Maucherat
• 2026/09/22 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/22 (tomcat) branch 9.0.x updated: Fix IDE warning markt
• 2026/09/22 (tomcat) branch 10.1.x updated: Fix IDE warning markt
• 2026/09/22 (tomcat) branch 11.0.x updated: Fix IDE warning markt
• 2026/09/22 Re: [PR] Enforce write interest registration state [tomcat] via GitHub
• 2026/09/22 (tomcat) branch main updated: Suppress IDE warning markt
• 2026/09/22 Re: Coverity Issues Review Mark Thomas
• 2026/09/22 Re: (tomcat) 01/02: Implement TSL-PSK encryption for clustering Mark Thomas
• 2026/09/22 (tomcat) 02/02: Clarify the exclusion markt
• 2026/09/22 (tomcat) 01/02: Implement TSL-PSK encryption for clustering markt
• 2026/09/22 (tomcat) branch main updated (590267e7ef -> 23f25ee5c3) markt
• 2026/09/22 Re: [PR] Bump org.apache:apache from 38 to 39 [tomcat-maven-plugin] via GitHub
• 2026/09/22 (tomcat-maven-plugin) branch dependabot/maven/org.apache-apache-40 created (now f11a94b) github-bot
• 2026/09/22 (tomcat-maven-plugin) branch dependabot/maven/org.apache-apache-39 deleted (was ffa6f99) github-bot
• 2026/09/22 [PR] Bump org.apache:apache from 38 to 40 [tomcat-maven-plugin] via GitHub
• 2026/09/22 Re: [PR] Bump org.apache:apache from 38 to 39 [tomcat-maven-plugin] via GitHub
• 2026/09/22 Re: Coverity Issues Review Fatima Qaisar
• 2026/09/22 Buildbot success in on tomcat-12.0.x buildbot
• 2026/09/22 Buildbot success in on tomcat-9.0.x buildbot
• 2026/09/22 (tomcat-native) 02/02: Add client-side PSK support for TLSv1.2 markt
• 2026/09/22 (tomcat-native) 01/02: Move to correct section markt
• 2026/09/22 (tomcat-native) branch main updated (84c6f655d -> b7c6d465a) markt
• 2026/09/22 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/22 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/22 (tomcat) branch main updated: Improve test and add no arg constructor remm
• 2026/09/22 Buildbot failure in on tomcat-12.0.x buildbot
• 2026/09/22 (tomcat) branch 9.0.x updated: Add missing @Override markt
• 2026/09/22 (tomcat) branch 10.1.x updated: Add missing @Override markt
• 2026/09/22 (tomcat) branch 11.0.x updated: Add missing @Override markt
• 2026/09/22 (tomcat) branch main updated: Add missing @Override markt
• 2026/09/22 (tomcat) 02/02: Expand the PSK support to cover OpenSSL-FFM markt
• 2026/09/22 (tomcat) 01/02: Add support for pre-shared keys with Tomcat Native TLS connections. markt
• 2026/09/22 (tomcat) branch main updated (337d9f0171 -> 2ad4b3d7ef) markt
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Mark Thomas
• 2026/09/22 Re: Potential changes to OpenSSL[-FFM] OCSP validation Rémy Maucherat
• 2026/09/22 Buildbot success in on tomcat-10.1.x buildbot
• 2026/09/22 [Bug 70247] New: HTTP/2: unread request body is never returned to the connection flow control window bugzilla
• 2026/09/22 Potential changes to OpenSSL[-FFM] OCSP validation Mark Thomas
• 2026/09/22 Buildbot success in on tomcat-11.0.x buildbot
• 2026/09/22 Buildbot success in on tomcat-12.0.x buildbot
• 2026/09/22 (tomcat) branch main updated: Allow alternate protocols remm
• 2026/09/22 (tomcat) branch 9.0.x updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 (tomcat) branch 10.1.x updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 (tomcat) branch 11.0.x updated: Remove unwanted change remm
• 2026/09/22 (tomcat) branch main updated: Remove unwanted change remm
• 2026/09/22 Re: (tomcat) branch main updated: Update documentation for the switch to 25 for FFM Mark Thomas
• 2026/09/22 (tomcat) branch 11.0.x updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 (tomcat) branch main updated: Update documentation for the switch to 25 for FFM remm
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Rémy Maucherat
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Mark Thomas
• 2026/09/22 Re: (tomcat) branch main updated: Bump Java needed to build to 25 Rémy Maucherat
• 2026/09/22 Re: Buildbot failure in on tomcat-12.0.x Rémy Maucherat
• 2026/09/22 Buildbot failure in on tomcat-10.1.x buildbot
• 2026/09/22 (tomcat) branch 11.0.x updated: Bump Java needed to build to 25 remm
• 2026/09/22 Buildbot failure in on tomcat-11.0.x buildbot
• 2026/09/22 (tomcat) branch 9.0.x updated: Bump Java needed to build to 25 remm
• 2026/09/22 (tomcat) branch 10.1.x updated: Bump Java needed to build to 25 remm
• 2026/09/22 Buildbot failure in on tomcat-12.0.x buildbot
• 2026/09/22 (tomcat) branch main updated: Bump Java needed to build to 25 remm
• 2026/09/21 Buildbot failure in on tomcat-9.0.x buildbot
• 2026/09/21 Re: [PR] New manager webapp for Tomcat [tomcat] via GitHub
• 2026/09/21 [Bug 70245] New: Documentation update required for Tomcat Native configuration guide bugzilla
• 2026/09/21 Re: (tomcat) 02/02: Align with recent Native changes to add PSK support Mark Thomas
• 2026/09/21 (tomcat) 02/02: Align with recent Native changes to add PSK support markt
• 2026/09/21 (tomcat) 01/02: Mirror changes in Native for PSK support with TLS 1.2 markt

• Earlier messages
• Later messages