You are viewing a plain text version of this content. The canonical link for it is here.
- [ANN] Apache Tomcat Native 2.0.16 released - posted by Mark Thomas <ma...@apache.org> on 2026/09/07 20:57:56 UTC, 0 replies.
- [ANN] Apache Tomcat Native 1.3.9 released - posted by Mark Thomas <ma...@apache.org> on 2026/09/07 20:57:58 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.60 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/09/15 11:24:25 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.26 Available - posted by Mark Thomas <ma...@apache.org> on 2026/09/15 15:09:30 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.122 available - posted by Rémy Maucherat <re...@apache.org> on 2026/09/15 20:22:09 UTC, 0 replies.
- [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:22 UTC, 0 replies.
- [SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:28 UTC, 0 replies.
- [SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:33 UTC, 0 replies.
- [SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:38 UTC, 0 replies.
- [SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:42 UTC, 0 replies.
- [SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:46 UTC, 0 replies.
- [SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:51 UTC, 0 replies.
- [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:55 UTC, 0 replies.
- [SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:58 UTC, 0 replies.
- [SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:02:03 UTC, 0 replies.
- [SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:02:07 UTC, 0 replies.
- [SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:02:12 UTC, 0 replies.
- [SECURITY] CVE-2026-86243 Apache Tomcat Native - DoS via TLS handshake - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 12:21:04 UTC, 0 replies.
- [SECURITY] CVE-2026-86246 Apache Tomcat Native - Insecure OpenSSL options enabled - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 12:21:10 UTC, 0 replies.
- [SECURITY] CVE-2026-86247 Apache Tomcat Native - Client certificate requirements can be down-graded - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 12:21:16 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:35:06 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:41:41 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:41:54 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:03 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:10 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:17 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:24 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:33 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:42 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:49 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:56 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:43:04 UTC, 0 replies.