Re: Possible missing CVE commits in 9.0.120, 10.1.57 and 11.0.24 release builds

16 Jul 2026 21:00:21 Thomas Williams <[email protected]>:

> Hi Tomcat Team,
>
> I noticed a discrepancy between the recent release documentation and 
> the
> actual release artifacts for Tomcat 9.0.120, 10.1.57 and 11.0.24.
>
> The release notes state that CVE-2026-59084 was fixed via commits 
> 617d7275
> for 9.0.120, 79466463 for 10.1.57 and 57e80e9b 11.0.24. However, 
> checking
> the source tree for the 9.0.120, 10.1.57 and 11.0.24 tags, these 
> commits do
> not appear to be merged into the release builds.
>
> Could someone please verify if these fixes were accidentally omitted 
> from
> the artifacts, or if the release notes are pointing to the wrong commit
> references?

My mistake. I picked the wrong doc change. The correct one is the earlier 
commit that is included in those releases that adds details about 
ordering requirements.

I'll correct that next week unless another committee gets there first.

Mark