< back to search

gpp_maybe Security update for tomcat10
SUSE-SLE-Module-Web-Scripting-15-SP7-2026-3418

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass (bsc#1271397). - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398). Other updates and bugfixes: - Tomcat 10.1.57: * Catalina + Fix: Avoid a race condition with concurrent lookups for a singleton JNDI resource. (markt) + Fix: Improve the performance of range validation for the default servlet. (markt) + Fix: Avoid NPE in RewriteValve. (markt) + Fix: 70127: Fix use of Bootstrap through reflection by restoring the public constructor. Use through scripts was not affected. (remm) + Fix: Restore ability to extend many element classes from AbstractAccessLogValve. (remm) + Fix: Align DIGEST authentication with RFC 7616 and require clients to provide a valid qop parameter. (markt) + Fix: Use Files API to create temporary docBase when antiLockingDocBase is enabled. (markt) + Fix: Improve validation of configuration when DataSourceRealm starts. (remm) + Fix: JAASRealm should do a logout if login does not fail outright but does not produce a Principal. (remm) + Fix: Various edge cases for SSI substitutions, quoting and escaping. (remm) + Fix: unintentional conversion of literal + to a space during rule processing in the RewriteValve. (markt) * Coyote + Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native is not available when the connector is explicitly configured to use Tomcat Native with OpenSSL for TLS. (markt) * Jasper + Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix for 69333) was incomplete and tags that threw exceptions in doStartTag() and doEndTag() were incorrectly re-used. This fix prevents tags from being re-used if such an exception occurs. (markt) + Fix: 70135: Fix security classload regression. (remm) + Add: support for specifying Java 28 (with the value 28) as the compiler source and/or compiler target for JSP compilation. If used with an Eclipse JDT compiler version that does not support these values, a warning will be logged and the default will be used. (markt) * WebSocket + Fix: 70126: Fix WebSocket extension permessage-deflate so that it does not drop bytes if a compressed message inflates to more than the available buffer. Fix written by GPT-5.5. Test case written by Hironori Ichimiya. (markt) + Fix: Optimise WebSocket client processing of server responses during WebSocket HTTP upgrade process. (markt) * Other + Update: Byte Buddy to 1.18.9. (markt) + Update: UnboundID to 7.0.5. (markt) + Update: JaCoCo to 0.8.15. (markt) + Update: BND to 7.3.0. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji. (markt)

cloud_download Downloads

Web and Scripting Module 15.7 aarch64
  • Packages
    tomcat10
    Apache Servlet/JSP/EL Engine, RI for Servlet 6.0/JSP 3.1/EL 5.0 API
    10.1.57-150200.5.73.1 lock rpm lock src
    tomcat10-admin-webapps
    The host manager and manager web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-el-5_0-api
    Expression Language v5.0 API
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-jsp-3_1-api
    Apache Tomcat JSP API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-lib
    Libraries needed to run the Tomcat Web container
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-servlet-6_0-api
    Apache Tomcat Servlet API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-webapps
    ROOT and examples web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
Web and Scripting Module 15.7 ppc64le
  • Packages
    tomcat10
    Apache Servlet/JSP/EL Engine, RI for Servlet 6.0/JSP 3.1/EL 5.0 API
    10.1.57-150200.5.73.1 lock rpm lock src
    tomcat10-admin-webapps
    The host manager and manager web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-el-5_0-api
    Expression Language v5.0 API
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-jsp-3_1-api
    Apache Tomcat JSP API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-lib
    Libraries needed to run the Tomcat Web container
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-servlet-6_0-api
    Apache Tomcat Servlet API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-webapps
    ROOT and examples web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
Web and Scripting Module 15.7 s390x
  • Packages
    tomcat10
    Apache Servlet/JSP/EL Engine, RI for Servlet 6.0/JSP 3.1/EL 5.0 API
    10.1.57-150200.5.73.1 lock rpm lock src
    tomcat10-admin-webapps
    The host manager and manager web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-el-5_0-api
    Expression Language v5.0 API
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-jsp-3_1-api
    Apache Tomcat JSP API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-lib
    Libraries needed to run the Tomcat Web container
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-servlet-6_0-api
    Apache Tomcat Servlet API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-webapps
    ROOT and examples web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
Web and Scripting Module 15.7 x86_64
  • Packages
    tomcat10
    Apache Servlet/JSP/EL Engine, RI for Servlet 6.0/JSP 3.1/EL 5.0 API
    10.1.57-150200.5.73.1 lock rpm lock src
    tomcat10-admin-webapps
    The host manager and manager web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-el-5_0-api
    Expression Language v5.0 API
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-jsp-3_1-api
    Apache Tomcat JSP API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-lib
    Libraries needed to run the Tomcat Web container
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-servlet-6_0-api
    Apache Tomcat Servlet API implementation classes
    10.1.57-150200.5.73.1 lock rpm
    tomcat10-webapps
    ROOT and examples web applications for Apache Tomcat
    10.1.57-150200.5.73.1 lock rpm