HeroDevs
Visit NES for Apache Tomcat Home Page

NES for Apache Tomcat Release Notes

Comprehensive release notes and changelog for NES for Apache Tomcat, including security patches, bug fixes, and feature updates across all supported versions.

62 Patched Vulnerabilities
VEX Statements

September 2026

8.5.112

Released Sep 25, 2026
CVE-2026-73581
CVE-2026-75973
CVE-2026-76183
CVE-2026-77756
CVE-2026-77762
5 More
Full Version: 
8.5.100-tomcat-8.5.112

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.112/tomcat-nes-v8.5.112.zip.
  • Tomcat Native 1.2.23 or later is now required (1.2.22 was never released). Older versions are no longer loaded, so the APR connector and OpenSSL-based TLS are unavailable until Tomcat Native is upgraded. This prevents a JVM crash in Tomcat Native 1.2.17 through 1.2.21 when a certificate revocation list is configured.

Security Fixes

  • OpenSSLContext.addCertificate can no longer omit configured certificate revocation lists when a server certificate is loaded from a Java key store (CVE-2026-73581). When Tomcat uses OpenSSL for TLS (the APR connector, or OpenSSLImplementation) with a key store certificate, the configured CRL is now loaded into OpenSSL, so it must be PEM encoded: a DER-encoded CRL makes TLS initialization fail and the connector can no longer accept TLS connections (convert it with openssl crl -inform DER -in crl.der -out crl.pem). Loading the CRL this way requires Tomcat Native 1.2.23 or later (1.2.22 was never released), because Tomcat Native 1.2.17 through 1.2.21 crash the JVM when a CRL is configured.
  • SimpleAuthConfigProvider no longer shares a ServerAuthConfig, callback handler, and realm across web applications (CVE-2026-75973).
  • WsServerContainer.findMapping() no longer interprets brace-wrapped WebSocket request path segments as URI template parameters that may bypass container security constraints (CVE-2026-76183).
  • Http11Processor.prepareInputFilters() no longer accepts a Transfer-Encoding header on HTTP/1.0 or earlier requests (CVE-2026-77756).
  • HpackDecoder can no longer emit headers into a recycled HTTP/2 Stream after concurrent stream replacement (CVE-2026-77762).
  • WsRemoteEndpointImplServer.acquireMessagePartInProgressSemaphore no longer busy-waits while sending a WebSocket close message when another thread holds the message-part semaphore (CVE-2026-77791).
  • Errored AJP responses can no longer block AjpProcessor.finishResponse() while waiting for a request-body packet the client does not send (CVE-2026-78383).
  • An asynchronous WebSocket write is no longer dropped from WsWriteTimeout tracking when another write shares its timeout-expiry millisecond, so every pending write still times out and a stalled write can no longer hold its connection and resources open indefinitely (CVE-2026-79677).
  • An invalid HTTP/2 header field no longer makes HpackDecoder abandon the rest of the header block and desynchronize the HPACK dynamic table, so later requests on the same connection can no longer be decoded against the wrong headers (CVE-2026-86350).
  • PerMessageDeflate no longer drops compressed input after an early BFINAL block within a multi-block WebSocket message (CVE-2026-87022).

8.5.111

Released Sep 18, 2026
CVE-2026-73180
CVE-2026-68525
Full Version: 
8.5.100-tomcat-8.5.111

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.111/tomcat-nes-v8.5.111.zip.

Security Fixes

  • Patched the medium Apache Tomcat vulnerability in WsServerContainer where rotating an HTTP session ID leaves an authenticated WebSocket open after the HTTP session ends (CVE-2026-73180).
  • Patched the low Apache Tomcat vulnerability in FormAuthenticator where restoring a saved request can change its HTTP method without refreshing the applicable security constraints, allowing a method-specific role restriction to be bypassed (CVE-2026-68525).

8.5.110

Released Sep 2, 2026
CVE-2026-65182
CVE-2025-66614
CVE-2026-65637
CVE-2026-65905
CVE-2026-65927
3 More
Full Version: 
8.5.100-tomcat-8.5.110

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.110/tomcat-nes-v8.5.110.zip.

Security Fixes

  • Patched the Critical Severity Apache Tomcat vulnerability in RealmBase.findSecurityConstraints() where a short URL pattern can overwrite a longer match and cause a more restrictive security constraint to be bypassed (CVE-2026-65182).
  • Patched the Medium Severity Apache Tomcat vulnerability in Stream.receivedEndOfHeaders() which never required an authority to be present, so an HTTP/2 request that omits both :authority and Host was accepted and processed. Open source 8.5.100 is not vulnerable, but this vulnerability was introduced into NES 8.5.100-tomcat-8.5.105 along with the fix to CVE-2025-66614 that introduced strictSni/checkSni. (CVE-2026-65637).
  • Patched the Low Severity Apache Tomcat vulnerability in DigestAuthenticator.NonceInfo.nonceCountValid where a nonce count at the upper replay-window boundary is immediately forgotten, allowing one authenticated request replay (CVE-2026-65905).
  • Patched the High Severity Apache Tomcat vulnerability in RewriteValve where rewrite processing after an [N] rule resumes at the second rule and can skip a first rule that enforces access control (CVE-2026-65927).
  • Patched the High Severity Apache Tomcat vulnerability in RealmBase.hasRole where servlet-scoped security-role-ref aliases can be substituted while evaluating declarative security constraints (CVE-2026-66422).
  • Patched the High Severity Apache Tomcat vulnerability in DataSourceRealm.getPrincipal() and JDBCRealm.getPrincipal() where CLIENT-CERT and SPNEGO authentication can accept users absent from the configured realm database (CVE-2026-68569).
  • Patched the High Severity Apache Tomcat vulnerability in Http2UpgradeHandler where resetting streams while the connection flow-control window is exhausted leaks backlog accounting and window capacity, preventing later streams from making progress (CVE-2026-68763).

July 2026

8.5.109

Released Jul 21, 2026
CVE-2026-59084
Full Version: 
8.5.100-tomcat-8.5.109

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.109/tomcat-nes-v8.5.109.zip.

Security Fixes

  • Clearly document EncryptInterceptor requirements.

8.5.108

Released Jul 15, 2026
CVE-2026-59083
Full Version: 
8.5.100-tomcat-8.5.108

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.108/tomcat-nes-v8.5.108.zip.

Security Fixes

  • Fix unintentional conversion of '+' to ' ' during rule processing.

8.5.107

Released Jul 1, 2026
CVE-2026-50229
CVE-2026-53404
CVE-2026-55276
CVE-2026-55955
CVE-2026-55956
1 More
Full Version: 
8.5.100-tomcat-8.5.107

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.107/tomcat-nes-v8.5.107.zip.

Security Fixes

  • Restrict wildcard property mapping in the bundled examples web application so internal-only properties are no longer exposed to clients.
  • Correct ornext processing in the RewriteValve so that non-OR conditions are still evaluated after an OR condition matches.
  • Include special roles and empty authorization constraints when logging the effective web.xml.
  • Protect the EncryptInterceptor against replay attacks.
  • Honor the HTTP method (or method omission) configured on security constraints for the default servlet.
  • Restore the missing step in the JNDIRealm GSSAPI authenticated bind flow so authentication cannot succeed without the correct password.

May 2026

8.5.106

Released May 15, 2026
CVE-2026-43515
CVE-2026-43514
CVE-2026-43513
CVE-2026-43512
CVE-2026-42498
2 More
Full Version: 
8.5.100-tomcat-8.5.106

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.106/tomcat-nes-v8.5.106.zip.

Security Fixes

  • Correctly apply HTTP method constraints when multiple security constraints share the same extension pattern.
  • Use a constant time comparison for the AJP secret.
  • Align the case sensitivity of user names in the LockOut Realm with the wrapped Realm.
  • Reject DIGEST authentication requests for users not known to the configured Realm.
  • Do not present the authentication header to the redirect target when the WebSocket client follows a redirect.
  • Validate HTTP/2 request headers.
  • Enforce a limit on the request body for WebDAV LOCK and PROPFIND requests.

April 2026

8.5.105

Released Apr 13, 2026
CVE-2026-24880
CVE-2026-25854
CVE-2026-29146
CVE-2026-32990
CVE-2025-66614
2 More
Full Version: 
8.5.100-tomcat-8.5.105

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.105/tomcat-nes-v8.5.105.zip.

Security Fixes

  • Add validation of chunk extensions.
  • Fix slash handling for path parameters.
  • Add support for new algorithms provided by JPA providers.
  • Fix case sensitive handling of the protocol host name.
  • Expand access log escaping.
  • Better error handling.
    • This fixes a High Severity Incorrectly Configured Access Control vulnerability CVE-2026-34486
    • Note that this fix is a continuation of the fix for CVE-2026-29146 that was found to have an error that allowed the EncryptInterceptor to be bypassed.

February 2026

8.5.104

Released Feb 24, 2026
CVE-2025-66614
CVE-2026-24733
Full Version: 
8.5.100-tomcat-8.5.104

Notes

    • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.104/tomcat-nes-v8.5.104.zip.

Security Fixes

  • Add protocol host name and SNI host name matching; Add strictSNI attribute on the Connector to control it; Add support for NIO2; Add support for APR.
  • HTTP/0.9 now only allows GET

November 2025

8.5.103

Released Nov 3, 2025
CVE-2025-55752
CVE-2025-55754
CVE-2025-61795
Full Version: 
8.5.100-tomcat-8.5.103

Notes

  • This release includes a compatibility fix for a deadlock that can occur when Tomcat is used with Spring Boot 1.5.
  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.103/tomcat-nes-v8.5.103.zip.

Security Fixes

  • Improve the locking strategy for StandardServer.services
    • This fixes a potential deadlock that was introduced in Tomcat 8.5.99 that broke compatibility with Spring Boot 1.5. OSS fixed the issue in 9.x but never backported the fix to 8.5. With this release, Tomcat will work with Spring Boot 1.5 again.
  • Fix a couple of issues with QSA/QSD handling and associated tests
  • Add escaping to logging output
  • Explicitly clean up after failed multi-part upload

July 2025

8.5.102

Released Jul 23, 2025
CVE-2025-52434
CVE-2025-52520
CVE-2025-53506
Full Version: 
8.5.100-tomcat-8.5.102

Notes

  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.102/tomcat-nes-v8.5.102.zip.

Security Fixes

8.5.101

Released Jul 10, 2025
CVE-2024-34750
CVE-2024-38286
CVE-2024-50379
CVE-2024-52316
CVE-2024-54677
9 More
Full Version: 
8.5.100-tomcat-8.5.101

Notes

  • This release originates from the open‑source Apache Tomcat project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
  • This release includes both maven packages and binaries. The binary packages for this release are available at https://registry.nes.herodevs.com/bin/org.apache.tomcat/tomcat-release/8.5.100-tomcat-8.5.101/tomcat-nes-v8.5.101.zip.

Security Fixes

  • Make counting of active streams more robust
  • Add support for re-keying with TLS 1.3
  • Fix inconsistent resource metadata with current GET and PUT/DELETE
  • If the Jakarta Authentication fails with an exception, set a 500 status
  • Fix Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.
  • Automate protection for CVE-2024-56337
  • Enhance lifecycle of temporary files used by partial PUT
  • Fix Apache Tomcat Denial of Service via invalid HTTP priority header
  • Fix Apache Tomcat Rewrite rule bypass
  • Refactor CGI servlet to access resources via WebResources and Use WebResource API to differentiate files and directories
  • Fix Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
  • Fix Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
  • Use the full path when calling icacls.exe
  • Expand checks for webAppMount