Re: Tomcat 11.0.25 Release Timeline Inquiry

JP,

On 8/8/26 3:46 AM, Mark Thomas wrote:
> 8 Aug 2026 02:42:51 João Paulo Simões Martins via users 
> <[email protected]>:
> 
>> Hi, thanks for the reply.
>>
>> So am I correct in assuming that the tomcat-embbeed 11.0.24 does not 
>> include the examples in it?
> 
> Yes.
> 
>> And if so, in your view, the CVE on owasp security scan should be 
>> considered a false positive?
> 
> Yes.
This is common for security scans which only take into account of 
version numbers for packages and dependencies, and not the usage of 
those dependencies.

Security scans of this nature need to be INPUT to your security 
management process, not the primary driver of your security process.

For example, CVE-2026-49844 [1] affects Apache log4j versions before 
2.25.5 and 2.26.1, and I have a fleet of applications that are all 
running version 2.25.4, so it comes up on our security scanner. We have 
a policy of deploying updates for CVEs within a short amount of time, so 
of course we *need* to deploy this update, right?

Well, no. It turns out that this CVE only applies to logging to JSON 
with a specific type of message resolver. We use neither, so our 
security process allows us to delay the roll-out of this update until a 
time that is more convenient to us.

I realize that every team wants "NO SECURITY ISSUES" to be displayed on 
their security dashboard, but it's really okay to have something that 
says "This is an issue, but it's very low priority and we expect it do 
be resolved by X date."

-chris

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-49844