You are viewing a plain text version of this content. The canonical link for it is here.
- Tomcat 9.0.37 - Request Header Parsing Exception: X-Forwarded-For Lost and Host Field Duplicated Resulting in 400 Bad Request - posted by 扛起一片天！✨ <50...@qq.com> on 2026/04/01 09:33:11 UTC, 3 replies.
- [ANN] End Of Support for Tomcat Native 1.x - posted by Christopher Schultz <sc...@apache.org> on 2026/04/02 22:34:15 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.54 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/04/02 22:34:46 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.117 available - posted by Rémy Maucherat <re...@apache.org> on 2026/04/03 09:24:46 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.21 Available - posted by Mark Thomas <ma...@apache.org> on 2026/04/04 12:03:34 UTC, 0 replies.
- Re: Access log Bytes Written when compression is enabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/08 16:24:40 UTC, 0 replies.
- [SECURITY] CVE-2026-24880 Apache Tomcat - Request smuggling via invalid chunk extension - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:14 UTC, 0 replies.
- [SECURITY] CVE-2026-25854 Apache Tomcat - Occasionally open redirect - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:17 UTC, 0 replies.
- [SECURITY] CVE-2026-29129 Apache Tomcat - Configured TLS cipher preference order not preserved - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:19 UTC, 0 replies.
- [SECURITY] CVE-2026-29145 Apache Tomcat and Tomcat Native - OCSP checks sometimes soft-fail even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:22 UTC, 0 replies.
- [SECURITY] CVE-2026-29146 Apache Tomcat - EncryptInterceptor vulnerable to padding oracle attack by default - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:24 UTC, 0 replies.
- [SECURITY] CVE-2026-32990 Apache Tomcat - The fix for CVE-2025-66614 is incomplete - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:26 UTC, 0 replies.
- [SECURITY] CVE-2026-34483 Apache Tomcat - Incomplete escaping of JSON access logs - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:30 UTC, 0 replies.
- [SECURITY] CVE-2026-34486 Apache Tomcat - Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:32 UTC, 0 replies.
- [SECURITY] CVE-2026-34487 Apache Tomcat - Cloud membership for clustering component exposed the Kubernetes bearer token - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:34 UTC, 0 replies.
- [SECURITY] CVE-2026-34500 Apache Tomcat - OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:36 UTC, 0 replies.
- cgi not found - posted by Holger Klawitter <in...@klawitter.de> on 2026/04/10 12:39:54 UTC, 3 replies.
- Double Slash Conversion to Single Slash in URL Not Working - posted by "Grackin, Michael A. Mr. (Fed) via users" <us...@tomcat.apache.org> on 2026/04/10 19:22:41 UTC, 2 replies.
- Limits on redirect length - posted by Stephen Booth <s....@epcc.ed.ac.uk> on 2026/04/13 12:20:31 UTC, 1 replies.
- RE: [EXTERNAL] Re: Double Slash Conversion to Single Slash in URL Not Working - posted by "Grackin, Michael A. Mr. (Fed) via users" <us...@tomcat.apache.org> on 2026/04/14 16:22:24 UTC, 0 replies.
- Clarification on Tomcat 9.1 Release Timeline and Support Plans - posted by somasani nikhil <so...@gmail.com> on 2026/04/16 08:27:58 UTC, 1 replies.
- Community Over Code Conference, October 2026, Glasgow, Scotland, UK - posted by Christopher Schultz <ch...@christopherschultz.net> on 2026/04/28 16:03:44 UTC, 0 replies.