CVE-2026-41284

Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected

Description: No limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users.

Mitigation: Users of the affected versions should apply one of the following mitigations:

• Upgrade to Apache Tomcat 11.0.22 or later
• Upgrade to Apache Tomcat 10.1.55 or later
• Upgrade to Apache Tomcat 9.0.118 or later

Credit: This issue was identified by Dariusz Gońda

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2026-41284)

Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2026-41293)

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.(CVE-2026-42498)

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43512)

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43513)

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43514)

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43515)

Root has patched CVE-2026-41284 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

• Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

Bug Fix(es) and Enhancement(s):

• Tomcat fails to respond to client connections when using Java 8 [almalinux-9.8] (JIRA:AlmaLinux-257456)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
• tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
• tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
• tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
• tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
• tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)
• tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
• tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117. Older, unsupported versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

• CVE-2026-41284: tomcat6: WebDAV LOCK/PROPFIND unbounded request body DoS

• SECURITY UPDATE: multiple security fixes
  • debian/patches/CVE-2026-41284.patch: add a configurable maxRequestBodySize init-param to the WebDAV servlet to bound LOCK/PROPFIND XML request bodies; reject oversized bodies with 413 Request Entity Too Long. Includes the upstream BoundedByteArrayOutputStream helper and associated tests
  • CVE-2026-41284
  • debian/patches/CVE-2026-41293.patch: filter invalid HTTP/2 header names in HpackDecoder / HPackHuffman / Stream / Http2Parser using a new HttpParser.isToken-based check; folds upstream follow-up (HttpParser i>32 hex/decimal fix, additional LocalStrings keys, HpackHuffman field-name branch simplification) and ships the new TestHPackHuffman / TestHttp2Section_8_2 tests.
  • debian/patches/CVE-2026-41293-tests.patch: adapt TestHttp2Section_8_2 to the 9.0.31 readFrame(boolean) signature
  • CVE-2026-41293
  • debian/patches/CVE-2026-42498.patch: strip Authorization and Proxy-Authorization headers from WebSocket client userProperties after the proxy CONNECT, HTTP redirect, and successful upgrade paths so credentials are not leaked to redirect or proxy targets
  • CVE-2026-42498
  • debian/patches/CVE-2026-43512.patch: fix DIGEST authentication handling of unknown users and users with a null password so they cannot authenticate; adds regression tests to TestDigestAuthenticator
  • CVE-2026-43512
  • debian/patches/CVE-2026-43513.patch: add caseSensitive attribute to LockOutRealm and route usernames through a null-safe normalizeUsername helper so case-insensitive realms cannot be brute-forced by varying the case of the username. Folds the upstream Coverity NPE follow-up and adds the new TestLockoutRealm JUnit tests
  • CVE-2026-43513
  • debian/patches/CVE-2026-43514.patch: switch the AJP secret comparison in AjpProcessor to a constant-time comparison using the new ConstantTime utility; includes the upstream ByteChunk start-offset follow-up
  • CVE-2026-43514
  • debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension-based security constraints by moving the match bookkeeping inside the inner extension-pattern loop; adds the upstream TestRealmBase.testUncoveredMethods regression test and a TesterRequest.getRequestPathMB() helper
  • CVE-2026-43515

• CVE-2026-41284: tomcat6: WebDAV LOCK/PROPFIND unbounded request body DoS

• SECURITY UPDATE: add case sensitive attribute to LockOutRealm
  • debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm
  • CVE-2026-43513
• SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication
  • debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication
  • CVE-2026-43512
• SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm
  • debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm
  • CVE-2026-43514
• SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints
  • debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints
  • CVE-2026-43515
• SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies
  • debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies
  • CVE-2026-41284

• CVE-2026-43512: fix the handling of invalid users with DIGEST authentication
• CVE-2026-43513: add case sensitive attribute to LockOutRealm
• CVE-2026-43514: switch AJP secret comparison to a constant time algorithm
• CVE-2026-43515: ensure RealmBase finds all matching extension based constraints
• CVE-2026-41284: add a configurable limit for WebDAV XML request bodies
• CVE-2026-42498: fix WebSocket + proxy + DIGEST auth on proxy
• CVE-2026-41293: HTTP/2 header filtering — validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules

• SECURITY UPDATE: Authentication Bypass in digest authentication
  • debian/patches/CVE-2026-43512.patch: reject digest authentication attempts for unknown users in getDigest()
  • CVE-2026-43512
• SECURITY UPDATE: Account lockout bypass in LockOutRealm via case variation of user names
  • debian/patches/CVE-2026-43513.patch: add a caseSensitive attribute to LockOutRealm and treat user names case-insensitively by default
  • CVE-2026-43513
• SECURITY UPDATE: Observable timing discrepancy in AJP secret comparison
  • debian/patches/CVE-2026-43514.patch: add ConstantTime helper and switch the AJP secret comparison to a constant time algorithm
  • CVE-2026-43514
• SECURITY UPDATE: Improper authorisation when multiple method constraints define an HTTP method for the same extension
  • debian/patches/CVE-2026-43515.patch: evaluate findMethod() against every matching SecurityCollection rather than only the last one
  • CVE-2026-43515
• SECURITY UPDATE: Exposure of HTTP authorisation header to unexpected hosts during WebSocket authentication
  • debian/patches/CVE-2026-42498.patch: drop the cached Authorization header from userProperties before following a WebSocket upgrade redirect so it is not sent to the host named in Location
  • CVE-2026-42498
• SECURITY UPDATE: HTTP/2 header values were not validated for control characters and other illegal bytes
  • debian/patches/CVE-2026-41293.patch: validate field names and values in HpackDecoder and HPackHuffman using the new HttpParser isFieldVChar / isFieldContent tables
  • CVE-2026-41293
• SECURITY UPDATE: Allocation of resources without limits in WebDAV LOCK and PROPFIND request bodies
  • debian/patches/CVE-2026-41284.patch: read PROPFIND and LOCK bodies through a new BoundedByteArrayOutputStream limited by the new maxRequestBodySize init parameter (default 4096 bytes)
  • CVE-2026-41284

• SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication
  • debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication
  • CVE-2026-43512
• SECURITY UPDATE: add case sensitive attribute to LockOutRealm
  • debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm
  • CVE-2026-43513
• SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm
  • debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm
  • CVE-2026-43514
• SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints
  • debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints
  • CVE-2026-43515
• SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies
  • debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies
  • CVE-2026-41284
• SECURITY UPDATE: fix WebSocket + proxy + DIGEST auth on proxy
  • debian/patches/CVE-2026-42498.patch: fix WebSocket + proxy + DIGEST auth on proxy
  • CVE-2026-42498
• SECURITY UPDATE: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules
  • debian/patches/CVE-2026-41293.patch: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules
  • CVE-2026-41293
• Build: refresh debian/test_certs/ test fixtures (CA + RSA/EC server certs + client cert) — upstream localhost-rsa.jks is expired since 2025-02-16 and 8.5.x is no longer rotated; new fixtures are signed by a fresh self-signed CA with 10-year validity, applied via the existing TEST_CERTS_DIR overlay in debian/rules.

TuxCare rebuilt 5 packages to address 2 CVEs. Fixed in 10.1.42-tuxcare.10.

TuxCare rebuilt 6 packages to address 17 CVEs. Fixed in 10.1.33-tuxcare.1.

TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.50-tuxcare.1.

TuxCare rebuilt 4 packages to address 7 CVEs. Fixed in 10.1.18-tuxcare.8.

TuxCare rebuilt 5 packages to address 15 CVEs. Fixed in 10.1.16-tuxcare.1.

Unbounded read in WebDAV LOCK and PROPFIND handling. (CVE-2026-41284) HTTP/2 request headers not validated. (CVE-2026-41293) WebSocket authentication header exposure. (CVE-2026-42498) Digest authenticator will authenticate any unknown user. (CVE-2026-43512) LockOutRealm treats user names as case-sensitive. (CVE-2026-43513) AJP secret compared in non-constant time. (CVE-2026-43514) Security constraints not correctly applied. (CVE-2026-43515)

These are all security issues fixed in the tomcat-9.0.118-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.55-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat11-11.0.22-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tomcat fixes the following issues

Update to Tomcat 9.0.118:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.22:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat10 fixes the following issues

Update to Tomcat 10.1.55:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat fixes the following issues

Update to Tomcat 9.0.118:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.22:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat10 fixes the following issues

Update to Tomcat 10.1.55:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat fixes the following issues

Update to Tomcat 9.0.118:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.22:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat10 fixes the following issues

Update to Tomcat 10.1.55:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

This update for tomcat fixes the following issues

Update to Tomcat 9.0.118:

• CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
• CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
• CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
• CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
• CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
• CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
• CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

Changes:

• Catalina

• Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and OpenSSL version information (both APR and FFM implementations), along with version compatibility warnings and third-party library version information. (csutherl)
• Code: Refactor generation of the remote user element in the access log to remove unnecessary code. (markt)
• Fix: Fix a regression in the previous release that meant ?- could appear in the access log rather than ? when the query string was present but empty. (markt)
• Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by Mahmoud Alarby. (remm)
• Fix: Align the escaping in ExtendedAccessLogValve with the other AccessLogValve implementations. (markt)
• Fix: 70000: fix duplication of special headers in the response after commit, following fix for 69967. (remm)
• Fix: Correct the handling of URIs mapped to a security constraint that only specifies the special ** role for all authenticated users. Requests without authentication were receiving 403 responses rather than 401 responses. (markt)
• Fix: Fix a race condition in StandardContext.getServletContext() that could cause the jakarta.servlet.context.tempdir attribute to be lost during a context reload. Make the context field volatile and use locking to ensure only one ApplicationContext instance is created. (dsoumis)
• Fix: Update the Windows authentication (kerberos) documentation to reflect that both Java and Windows are removing / have removed support for RC4-HMAC. The guide now uses AES256-SHA1. (markt)
• Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize which limits the size of a WebDAV request body for LOCK and PROPFIND. The default value is 4096 bytes. (markt)
• Add: Add a new caseSensitive attribute to the LockOutRealm that controls the manner in which user names are treated when making locking decisions. The default is false, meaning user names are treated in a case insensitive manner. (markt)
• Fix: Correct the handling of invalid users with DIGEST authentication. (markt)
• Fix: Ensure RealmBase finds all matching extension based security constraints. (markt)

• Coyote

• Fix: Avoid various edge cases if Content-Length is set via setHeader(String,String) or addHeader(String,String) with an invalid value by always clearing the previous value whether the new value is valid or not and ignoring any invalid new value. (markt)
• Code: Refactor the calculation of the real index in the HPACK dynamic header table implementation to reduce code duplication. (markt)
• Fix: Fix various minor issues with some HTTP/2 stream error messages for HTTP/2. (markt)
• Fix: Consistently reject URIs containing NULL bytes when normalizing.
• Fix: Fix a few minor memory leaks on error paths reading TLS keys and certificates when using FFM. (markt)
• Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC after a stream reset. (markt)
• Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields not permitted in trailers. (markt)
• Fix: Free private keys after use in FFM based connector configuration.
• Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header decoding that could result in a valid header triggering an unexpected connection close. (markt)
• Fix: Refactor HTTP/2…

It was discovered that Tomcat did not properly limit the size of WebDAV LOCK and PROPFIND request bodies. A remote attacker could use this issue to cause Tomcat to consume excessive memory, resulting in a denial of service. (CVE-2026-41284)

It was discovered that Tomcat incorrectly validated HTTP/2 header fields. A remote attacker could use this issue to cause Tomcat to crash or possibly execute arbitrary code. (CVE-2026-41293)

It was discovered that Tomcat did not properly clear HTTP authentication headers during WebSocket connection upgrades and redirects. A remote attacker could use this issue to obtain sensitive credentials. (CVE-2026-42498)

It was discovered that Tomcat incorrectly handled digest authentication. A remote attacker could possibly use this issue to bypass authentication restrictions. (CVE-2026-43512)

It was discovered that Tomcat incorrectly handled case sensitivity in LockOutRealm. A remote attacker could possibly use this issue to bypass account lockout protections and obtain sensitive information. (CVE-2026-43513)

It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote attacker could possibly use this issue to bypass authorization restrictions. (CVE-2026-43515)