You are viewing a plain text version of this content. The canonical link for it is here.
- [ANN] End Of Support for Tomcat Native 1.x - posted by Christopher Schultz <sc...@apache.org> on 2026/04/02 22:34:15 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.54 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/04/02 22:34:46 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.117 available - posted by Rémy Maucherat <re...@apache.org> on 2026/04/03 09:24:46 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.21 Available - posted by Mark Thomas <ma...@apache.org> on 2026/04/04 12:03:34 UTC, 0 replies.
- [SECURITY] CVE-2026-24880 Apache Tomcat - Request smuggling via invalid chunk extension - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:14 UTC, 0 replies.
- [SECURITY] CVE-2026-25854 Apache Tomcat - Occasionally open redirect - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:17 UTC, 0 replies.
- [SECURITY] CVE-2026-29129 Apache Tomcat - Configured TLS cipher preference order not preserved - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:19 UTC, 0 replies.
- [SECURITY] CVE-2026-29145 Apache Tomcat and Tomcat Native - OCSP checks sometimes soft-fail even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:22 UTC, 0 replies.
- [SECURITY] CVE-2026-29146 Apache Tomcat - EncryptInterceptor vulnerable to padding oracle attack by default - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:24 UTC, 0 replies.
- [SECURITY] CVE-2026-32990 Apache Tomcat - The fix for CVE-2025-66614 is incomplete - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:26 UTC, 0 replies.
- [SECURITY] CVE-2026-34483 Apache Tomcat - Incomplete escaping of JSON access logs - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:30 UTC, 0 replies.
- [SECURITY] CVE-2026-34486 Apache Tomcat - Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:32 UTC, 0 replies.
- [SECURITY] CVE-2026-34487 Apache Tomcat - Cloud membership for clustering component exposed the Kubernetes bearer token - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:34 UTC, 0 replies.
- [SECURITY] CVE-2026-34500 Apache Tomcat - OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:36 UTC, 0 replies.