tomcat10 (10.1.40-1ubuntu1.26.04.1) resolute-security; urgency=medium

  * SECURITY UPDATE: WebDAV resource exhaustion via unbounded
    request body
    - debian/patches/CVE-2026-41284.patch: limit LOCK and PROPFIND
      request body size using BoundedByteArrayOutputStream
    - CVE-2026-41284
  * SECURITY UPDATE: HTTP/2 header field validation bypass
    - debian/patches/CVE-2026-41293-pre.patch: add header validation
      infrastructure for HTTP/2 field names and values
    - debian/patches/CVE-2026-41293.patch: improve field-vchar
      validation and simplify error handling in HPackHuffman
    - CVE-2026-41293
  * SECURITY UPDATE: WebSocket authentication header leakage
    - debian/patches/CVE-2026-42498.patch: clear authentication
      headers after use and fix digest auth method handling
    - CVE-2026-42498
  * SECURITY UPDATE: digest authentication NPE bypass
    - debian/patches/CVE-2026-43512.patch: add null check for
      password in RealmBase.getDigest()
    - CVE-2026-43512
  * SECURITY UPDATE: LockOutRealm case sensitivity bypass
    - debian/patches/CVE-2026-43513.patch: normalize username case
      in LockOutRealm when caseSensitive is false
    - CVE-2026-43513
  * SECURITY UPDATE: authorization bypass via multiple method
    constraints
    - debian/patches/CVE-2026-43515.patch: check all matching
      SecurityCollection entries in RealmBase
    - CVE-2026-43515
  * debian/control: pin Build-Depends to openjdk-21-jdk to ensure the
    package builds against OpenJDK 21 on resolute

 -- Vyom Yadav <vyom.yadav@canonical.com>  Tue, 09 Jun 2026 17:38:21 +0530

tomcat10 (10.1.40-1ubuntu1) questing; urgency=medium

  * SECURITY UPDATE: Security Constraint Bypass
    - debian/patches/CVE-2025-46701.patch: Refactor CGI servlet to
      access resources via WebResources
    - CVE-2025-46701

 -- Bruce Cable <bruce.cable@canonical.com>  Fri, 20 Jun 2025 14:15:00 +1000

tomcat10 (10.1.40-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Look for OpenJDK from 11 to 25 when starting the server
  * Standards-Version updated to 4.7.2

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 03 Apr 2025 22:07:33 +0200

tomcat10 (10.1.35-1) unstable; urgency=medium

  * New upstream version 10.1.35.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Sun, 09 Feb 2025 00:19:28 +0100

tomcat10 (10.1.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 17 Dec 2024 08:16:03 +0100

tomcat10 (10.1.33-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 23 Nov 2024 19:37:37 +0100

tomcat10 (10.1.31-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 23 Oct 2024 18:33:07 +0200

tomcat10 (10.1.30-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Depend on libbyte-buddy-java instead of libcglib-nodep-java
  * Fixed the taglibs tests
  * Fixed the database tests
  * No longer attempt to run the non compiled TestJNDIRealmIntegration test

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 16 Sep 2024 18:47:28 +0200

tomcat10 (10.1.25-2) unstable; urgency=medium

  * Add the missing dependency on libeclipse-jdt-core-compiler-batch-java
    (Closes: #1078372)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 20 Aug 2024 17:47:28 +0200

tomcat10 (10.1.25-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 03 Jul 2024 23:57:31 +0200

tomcat10 (10.1.23-1) unstable; urgency=medium

  * New upstream version 10.1.23
  * Refresh the patches.
  * Declare compliance with Debian Policy 4.7.0.

 -- Markus Koschany <apo@debian.org>  Thu, 18 Apr 2024 22:34:59 +0200

tomcat10 (10.1.20-1) unstable; urgency=high

  * New upstream version 10.1.20.
    - Fix CVE-2024-24549: Denial of Service due to improper input validation
      vulnerability. (Closes: #1066878)
    - Fix CVE-2024-23672: Denial of Service via incomplete cleanup
      vulnerability. (Closes: #1066877)
  * Remove obsolete dependency on lsb-base from tomcat10 binary package.

 -- Markus Koschany <apo@debian.org>  Sat, 06 Apr 2024 13:43:19 +0200

tomcat10 (10.1.16-1) unstable; urgency=medium

  * New upstream version 10.1.16.
    - Fix CVE-2023-46589: potential request smuggling. (Closes: #1057082)

 -- Markus Koschany <apo@debian.org>  Sun, 03 Dec 2023 13:31:22 +0100

tomcat10 (10.1.15-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * Build depend on the versionless tomcat-jakartaee-migration jar.
    (Closes: #1054705)

  [ Markus Koschany ]
  * New upstream version 10.1.15.

 -- Markus Koschany <apo@debian.org>  Fri, 27 Oct 2023 22:40:52 +0200

tomcat10 (10.1.14-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 10 Oct 2023 09:44:59 +0200

tomcat10 (10.1.13-1) unstable; urgency=medium

  * New upstream version 10.1.13.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Fri, 01 Sep 2023 13:47:35 +0200

tomcat10 (10.1.10-1) unstable; urgency=medium

  * New upstream version 10.1.10.

 -- Markus Koschany <apo@debian.org>  Sun, 18 Jun 2023 18:16:33 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libtomcat10-embed-java`.
