- CVE-2026-24880: validate HTTP/1.1 chunk extensions with a new ChunkExtension state machine instead of skipping them unparsed, so a CRLF embedded in a quoted extension value can no longer desync Tomcat from a front-end proxy and smuggle a request - CVE-2026-25854: collapse leading slashes on the request URI and redirect via sendRedirect in the LoadBalancerDrainingValve so a protocol-relative URI can no longer be reflected into the Location header as an open redirect - CVE-2026-34483: escape the request URI and query string in the access log %r, %q and %U elements so log fields cannot be forged through unescaped output - CVE-2026-34487: stop logging the Kubernetes bearer token by dropping it from the tokenStream.failedConnection message and dropping the request headers from the cloud stream provider debug log