[ANN] Apache Tomcat 9.0.107 available

2025-07-04 Thread Rémy Maucherat
The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.107. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.107 is a bugfix and fe

[ANN] Apache Tomcat 11.0.9 Available

2025-07-04 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache Tomcat 11.0.9. Apache Tomcat 11 is an open source software implementation of the Jakarta Servlet, Jakarta Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations specifications.

[ANN] Apache Tomcat 10.1.43 Available

2025-07-04 Thread Christopher Schultz
The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.1.43. Apache Tomcat 10 is an open source software implementation of the Jakarta Servlet, Jakarta Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations specifications.

Re: Restricting POST request size in Tomcat

2025-07-04 Thread Martin Konicsek
Hi Perplexity  wrote The maxPostSize attribute only applies to requests where Tomcat parses form data (e.g., application/x-www-form-urlencoded). For raw POST bodies (like application/json), maxPostSize may not be enforced by default in all Tomcat versions. If you need to restrict POST size fo

Restricting POST request size in Tomcat

2025-07-04 Thread S Abirami
Hi Team, We are looking into possibility of restricting the POST request size having content-type application/json in Tomcat. We want to ensure that attacker should not hit Rest API request directly with large request data. Expecting Tomcat application server level configuration should declin

Re: Apache Tomcat 10.1.42 Cache-Control header changed when added security-constraint with transport-guarantee CONFIDENTIAL

2025-07-04 Thread Mark Thomas
On 04/07/2025 06:37, Rolandas Karosas | Edrana Baltic wrote: Different value for securePagesWithPragma on the authenticator for the two system being tested? No. authenticator is not used at all. Yes, it is. There are security constraints so there will be an authenticator even if it is the