* SECURITY UPDATE: Denial of service in HTTP/2 - a stream could be removed from the count of active streams more than once, driving the count below the real value, so an infinite connection timeout was applied and connections that should have been closed stayed open - debian/patches/CVE-2024-34750.patch: guard each stream with an AtomicBoolean so that it is removed from the active stream count at most once, and route the decrements through the new decrementActiveRemoteStreamCount(Stream) helper - CVE-2024-34750 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - on a case insensitive file system a race between a read and a concurrent write for the same path allowed an uploaded file to be picked up and compiled as a JSP - debian/patches/CVE-2024-50379.patch: add the WebResourceLockSet interface and serialise reads and writes for the same resource path in DirResourceSet and FileResource through a per-path read/write lock - CVE-2024-50379 * SECURITY UPDATE: Authentication bypass when a custom Jakarta Authentication component throws an exception without setting an HTTP status, leaving the response status at 200 - debian/patches/CVE-2024-52316.patch: explicitly set a 500 status in authenticateJaspic() when validateRequest() throws an AuthException - CVE-2024-52316 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - the mitigation for CVE-2024-50379 was incomplete because the JVM global canonical file name cache could still return a stale result for the concurrently written path - debian/patches/CVE-2024-56337.patch: disable the canonical file name cache before a potentially exposed WebResourceSet starts and refuse to start it if that cannot be confirmed, add Jre12Compat and Jre21Compat for the per Java version cache behaviour, and pass -Dsun.io.useCanonCaches=false from catalina.sh - CVE-2024-56337 * SECURITY UPDATE: Denial of service in HTTP/2 (MadeYouReset) - frames that make the server reset a stream were not counted against the connection overhead budget, so the CVE-2023-44487 mitigation never triggered - debian/patches/CVE-2025-48989.patch: count every RST_STREAM frame Tomcat sends using overheadResetFactor - CVE-2025-48989 * SECURITY UPDATE: Directory traversal via the RewriteValve, with possible remote code execution if PUT is enabled - the rewritten URL was normalized while still percent encoded, so an encoded ../ survived normalization and was decoded afterwards, letting the request escape into /WEB-INF/ or /META-INF/ - debian/patches/CVE-2025-55752.patch: decode the rewritten URL before normalizing it, and reject the request with a 400 when normalization reports that the path escapes root - CVE-2025-55752 * SECURITY UPDATE: Padding oracle in the cluster EncryptInterceptor - the interceptor accepted cipher mode and padding combinations that offer no protection, and the CBC modes it accepted are malleable and open to a padding oracle - debian/patches/CVE-2026-29146.patch: reject the cipher mode and padding combinations that offer no protection, warn for the CBC, CFB and OFB modes with PKCS5Padding that are kept for compatibility, and recognise GCM/NoPadding as the recommended transformation. The patch also carries the upstream partial revert 776e12b3, without which the fix would reintroduce CVE-2026-34486 by passing messages that failed to decrypt up the interceptor chain with their raw bytes. Note that, as upstream, explicit EncryptInterceptor configurations using a mode that offers no protection (NONE, ECB, PCBC, CTS, KW, KWP, CTR, and CBC, CFB or OFB with NoPadding) are now rejected at startup. The default AES/CBC/PKCS5Padding keeps working and only logs a recommendation to switch to AES/GCM/NoPadding - CVE-2026-29146