CVE-2026-55276

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

• Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

Bug Fix(es) and Enhancement(s):

• Tomcat fails to respond to client connections when using Java 8 [almalinux-9.8] (JIRA:AlmaLinux-257456)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

• CVE-2026-34487: stop logging the Kubernetes service account bearer token in the cloud membership provider, dropping the request headers from the connection debug message and the token from the failed-connection exception message (upstream tomcat 9.0.117)
• CVE-2026-55276: include the special roles * and ** and empty authorization constraints in the generated effective web.xml, so a logged effective web.xml no longer understates the security constraints that are in force (upstream tomcat 9.0.119)

• CVE-2025-49125: require the request path to end at the mount point or continue past it with a /, instead of testing the mount point as a bare string prefix, so a PreResources or PostResources set mounted below the web application root can no longer be reached via an unexpected path that is not covered by the same security constraints; also strip a trailing / from webAppMount in all cases, as upstream does, so a resource set mounted on a path ending in / keeps resolving its nested paths under the stricter check
• CVE-2026-55276: include the * and ** special roles and empty authorization constraints when generating the effective web.xml, so the logged descriptor no longer understates the security constraints that are actually in force

The updated packages fix security vulnerabilities: XSS in number guess example. (CVE-2026-50229) Bad ornext processing in RewriteValve. (CVE-2026-53404) Invalid CRL configuration doesn't trigger failure for FFM Connector. (CVE-2026-53434) Logged effective web.xml is incomplete. (CVE-2026-55276) EncryptInterceptor not protected against replay attacks. (CVE-2026-55955) Security constraints for default servlet ignored method. (CVE-2026-55956) Authentication bypass with JNDIRealm and GSSAPI authenticated bind. (CVE-2026-55957)

These are all security issues fixed in the tomcat11-11.0.23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat-9.0.119-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.56-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tomcat fixes the following issues

Update to Tomcat 9.0.119.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 9.0.119:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra Bogar. (markt)
    • Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    • Fix: When…

This update for tomcat10 fixes the following issues

Update to Tomcat 10.1.56.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 10.1.56:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra…

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.23.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Upgrade libtcnative to v2 (bsc#1232390)
• Tomcat 11.0.23:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Lower the log level to debug when OpenSSL initialization fails in OpenSSLLifecycleListener to avoid stack traces when libssl.so is not present and to align the behavior of the isAvailable() check with the AprLifecycleListener and gracefully fail when natives are not present. (csutherl)
    • Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave…

This update for tomcat fixes the following issues

Update to Tomcat 9.0.119.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 9.0.119:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra Bogar. (markt)
    • Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    • Fix: When…

This update for tomcat10 fixes the following issues

Update to Tomcat 10.1.56.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 10.1.56:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra…

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.23.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Upgrade libtcnative to v2 (bsc#1232390)
• Tomcat 11.0.23:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Lower the log level to debug when OpenSSL initialization fails in OpenSSLLifecycleListener to avoid stack traces when libssl.so is not present and to align the behavior of the isAvailable() check with the AprLifecycleListener and gracefully fail when natives are not present. (csutherl)
    • Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave…

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.23.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Upgrade libtcnative to v2 (bsc#1232390).
• Tomcat 11.0.23:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Lower the log level to debug when OpenSSL initialization fails in OpenSSLLifecycleListener to avoid stack traces when libssl.so is not present and to align the behavior of the isAvailable() check with the AprLifecycleListener and gracefully fail when natives are not present. (csutherl)
    • Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave…

This update for tomcat fixes the following issues

Update to Tomcat 9.0.119.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 9.0.119:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra Bogar. (markt)
    • Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    • Fix: When…

This update for tomcat10 fixes the following issues

Update to Tomcat 10.1.56.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 10.1.56:
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra…

This update for tomcat fixes the following issues

Update to Tomcat 9.0.119.

Security issues fixed:

• CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
• CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910).
• CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
• CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909).
• CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908).
• CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907).

Other updates and bugfixes:

• Tomcat 9.0.119
  • Catalina
    • Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt)
    • Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl)
    • Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt)
    • Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
    • Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm)
    • Fix: Incorrect session average life calculation. (remm)
    • Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm)
    • Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm)
    • Fix: Fix container event cleanups in some edge cases. (remm)
    • Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm)
    • Fix: Fix hour unit used by ExpiresFilter. (remm)
    • Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm)
    • Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz)
    • Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm)
    • Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm)
    • Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm)
    • Fix: Fix shared lock expiration in WebDAV. (remm)
    • Fix: Inaccurate session exipration statistics when using the persistent manager. (remm)
    • Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
    • Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm)
    • Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm)
    • Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm)
    • Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt)
    • Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra Bogar. (markt)
    • Fix: Fix connection leak in ProxyErrorReportValve. (remm)
    • Fix: When…

It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote attacker could possibly use this issue to bypass authorization restrictions. (CVE-2026-43515)

It was discovered that the Tomcat number guess example application did not properly sanitize user-supplied input. An attacker could possibly use this issue to inject malicious scripts, resulting in cross-site scripting. (CVE-2026-50229)

It was discovered that Tomcat incorrectly evaluated rewrite valve conditions in certain configurations. An attacker could possibly use this issue to bypass rewrite rules, resulting in unauthorized access. (CVE-2026-53404)

It was discovered that Tomcat incorrectly omitted certain authorization information when logging the effective web.xml configuration. An attacker could possibly use this issue to hide authorization constraints, resulting in reduced auditability. (CVE-2026-55276)