* SECURITY UPDATE: HTTP/2 header limit errors deferred until whole header block read - debian/patches/CVE-2024-24549.patch: validate headers after each HEADERS/CONTINUATION payload instead of only at end of block in java/org/apache/coyote/http2/Http2Parser.java, and swap the header emitter to the sink once validation fails in java/org/apache/coyote/http2/{Stream,Http2UpgradeHandler}.java - CVE-2024-24549 * SECURITY UPDATE: HTTP/2 active stream miscount leading to infinite connection timeout - debian/patches/CVE-2024-34750.patch: count each stream out of the active set exactly once in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler,Stream}.java - CVE-2024-34750 * SECURITY UPDATE: RCE via TOCTOU race in write-enabled default servlet on case insensitive file systems - debian/patches/CVE-2024-50379.patch: add path-keyed read/write locking via the new java/org/apache/catalina/WebResourceLockSet.java and use it in java/org/apache/catalina/webresources/{DirResourceSet,FileResource}.java - CVE-2024-50379 * SECURITY UPDATE: incomplete mitigation for CVE-2024-50379 on Java 8 and Java 11 - debian/patches/CVE-2024-56337.patch: set -Dsun.io.useCanonCaches=false before any file system access in bin/catalina.sh - CVE-2024-56337 * SECURITY UPDATE: authentication bypass when a Jakarta Authentication component throws - debian/patches/CVE-2024-52316.patch: set a 500 status when validateRequest() throws AuthException in java/org/apache/catalina/authenticator/AuthenticatorBase.java - CVE-2024-52316 * SECURITY UPDATE: HTTP/2 denial of service via client triggered server side stream resets - debian/patches/CVE-2025-48989.patch: charge server initiated resets to the overhead counter in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler}.java - CVE-2025-48989 * SECURITY UPDATE: directory traversal via Rewrite Valve normalizing before decoding - debian/patches/CVE-2025-55752.patch: decode the rewritten URL before normalizing it in java/org/apache/catalina/valves/rewrite/RewriteValve.java - CVE-2025-55752 * SECURITY UPDATE: EncryptInterceptor padding oracle from the CBC default - debian/patches/CVE-2026-29146.patch: reject cipher modes that provide no protection and warn on the weaker ones in java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java; AES/GCM/PKCS5Padding, AES/CBC/NoPadding, AES/CFB/NoPadding and AES/OFB/NoPadding are now refused at startup - CVE-2026-29146