* SECURITY UPDATE: fix for the following CVEs: - CVE-2025-48989: MadeYouReset HTTP/2 DoS — charge the connection overhead budget for server-initiated RST_STREAM frames in both Http2UpgradeHandler and Http2AsyncUpgradeHandler, and apply the initial HTTP/2 MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE limits immediately (force-set) rather than only after the client ACKs the SETTINGS frame, closing the "malformed control frame -> server RST" amplification loop. - CVE-2025-55752: RewriteValve query-string-append (QSA) path traversal — swap the normalize/decode order in RewriteValve.invoke() so the rewritten URL is URL-decoded before normalisation, preventing encoded traversal sequences such as %2F..%2F from surviving normalize() and later reaching /WEB-INF/ or /META-INF/. - CVE-2026-29146: EncryptInterceptor padding oracle — validate the configured cluster encryptionAlgorithm against an allow-list. GCM is now only accepted with NoPadding; NONE, ECB, PCBC, CTS, KW, KWP and CTR are refused outright, as are CBC, CFB and OFB with NoPadding and CFB/OFB at a non-default block size (CFB8, OFB64, ...); an unusable algorithm raises IllegalArgumentException at startup instead of failing later. CBC, CFB and OFB with PKCS5Padding continue to work but log a warning recommending AES/GCM/NoPadding. The default encryptionAlgorithm also changes from AES/CBC/PKCS5Padding to the authenticated AES/GCM/NoPadding, which is what actually removes the padding oracle for the deployments that never set the attribute explicitly. Rollout note: AES/GCM/NoPadding is not wire-compatible with AES/CBC/PKCS5Padding, so nodes on the old and new defaults cannot exchange cluster messages. The preferred procedure is to stop the whole cluster and restart it on the new package. If a rolling restart is unavoidable, first set encryptionAlgorithm="AES/CBC/PKCS5Padding" explicitly on every node, roll the package out, then remove that setting everywhere and restart once more. This pin is a rollout-window measure only and must not be left in place: for as long as it is set the cluster remains exposed to the padding oracle, and the fix is complete only once it has been removed.