CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

www/tomcat-devel11.0.27

Open-source Java web server by Apache, 11.0.x branch

0
unaddressed
0
VuXML only, still affected
15
fixed
Maintainer
vvd@FreeBSD.org
Packages
tomcat-devel 11.0.27
Upstream
up to date
CPE
apache:tomcat from the port
WWW
https://tomcat.apache.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (15)

Show 15 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-656379.82026-08-25Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, fro…
CVE-2026-659059.82026-08-25Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST au…
CVE-2026-685259.12026-08-25Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resou…
CVE-2026-651829.12026-08-25Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before…
CVE-2026-651838.12026-08-25Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix d…
CVE-2026-664228.12026-08-25Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the…
CVE-2026-685698.12026-08-25Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user di…
CVE-2026-659277.52026-08-25Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the firs…
CVE-2026-687637.52026-08-25Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach…
CVE-2026-731806.82026-08-25Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection ha…
CVE-2026-662995.32026-07-28Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.…

Commits (90)

Vladimir Druzenko (vvd) · 11.0.27
www/tomcat-devel: Update 11.0.26 => 11.0.27

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.27_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q4
3379dd1bfc
Vladimir Druzenko (vvd) · 11.0.26
www/tomcat-devel: Update 11.0.25 => 11.0.26

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.26_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q3
98833b1f3a
Vladimir Druzenko (vvd) · 11.0.25
www/tomcat-devel: Update 11.0.24 => 11.0.25

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.25_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q3
0ef1cfece3
Vladimir Druzenko (vvd) · 11.0.24
www/tomcat-devel: Update 11.0.22 => 11.0.24

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.24_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q2
afd6b5f85c
Michael Osipov (michaelo) · 11.0.22_1
www/tomcat-{9,101,110,devel}: Pass -procname to jsvc

Commons Daemon 1.6.0 gained the capability to invoke setproctitle(2) like
daemon(8). Pass ${name} to -proctitle.

Approved by:	vvd (maintainer)
Differential Revision:	https://reviews.freebsd.org/D57621
8fbf299d6f
Vladimir Druzenko (vvd) · 11.0.22
www/tomcat-devel: Update 11.0.21 => 11.0.22

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.22_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q2
fe91b9b9ee
Vladimir Druzenko (vvd) · 11.0.21
www/tomcat{-devel,101,110,9}: Improve ports (no functional changes)

Simplify MASTER_SITES and parametrize COMMENT.

Sponsored by:	UNIS Labs
462a109fd5
Vladimir Druzenko (vvd) · 11.0.21
www/tomcat-devel: Update 11.0.20 => 11.0.21

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.21_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q2
45d46736b3
Ronald Klop (ronald) · 11.0.20_1
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Vladimir Druzenko (vvd) · 11.0.20
www/tomcat-devel: Update 11.0.18 => 11.0.20

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.20_(markt)

MFH:	2026Q1
405288cb8c
Ronald Klop (ronald) · 11.0.18_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Vladimir Druzenko (vvd) · 11.0.18
www/tomcat-devel: Update 11.0.15 => 11.0.18

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.18_(markt)

MFH:	2026Q1
a61ac34cef
Vladimir Druzenko (vvd) · 11.0.15
www/tomcat-devel: Update 11.0.14 => 11.0.15

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.15_(markt)

MFH:	2025Q4
304b5416c1
Vladimir Druzenko (vvd) · 11.0.14
www/tomcat-devel: Update 11.0.13 => 11.0.14

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.14_(markt)

MFH:	2025Q4
cf5a086fe3
Vladimir Druzenko (vvd) · 11.0.13
www/tomcat-devel: Update 11.0.11 => 11.0.13

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.13_(mark)

MFH:	2025Q4
8d92b67a02
Vladimir Druzenko (vvd) · 11.0.11
www/tomcat-devel: Update 11.0.10 => 11.0.11

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.11_(markt)

MFH:	2025Q3
cbae2b629e
Vladimir Druzenko (vvd) · 11.0.10
www/tomcat-devel: Update 11.0.9 => 11.0.10

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.10_(markt)

Improve port.
Refresh patch.

Security:	CVE-2022-45143
MFH:		2025Q3
f781c1195a
Vladimir Druzenko (vvd) · 11.0.9
www/tomcat-devel: Update 11.0.7 => 11.0.8

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.8_(markt)

MFH:	2025Q3
1d136ce229
Vladimir Druzenko (vvd) · 11.0.8
www/tomcat-devel: Update 11.0.7 => 11.0.8

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.8_(markt)

MFH:	2025Q2
cc41ea0703
Vladimir Druzenko (vvd) · 11.0.7
www/tomcat-devel: Update 11.0.6 => 11.0.7

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.7_(markt)

MFH:	2025Q2
922d933b36
Vladimir Druzenko (vvd) · 11.0.6_2
www/tomcat{9,101,110,-devel}: Improve apply JAVA 9+ specific start-up parameters

after update jsvc form port devel/apache-commons-daemon

PR:	286524
MFH:	2025Q2
e778c13459
Vladimir Druzenko (vvd) · 11.0.6_1
www/tomcat{9,101,110,-devel}: Add the JAVA 9+ specific start-up parameters required by Tomcat

Default startup script set these parameters.
Without them, some applications do not work.

MFH:	2025Q2
8b3af89e8e
Vladimir Druzenko (vvd) · 11.0.6
www/tomcat-devel: Update 11.0.5 => 11.0.6

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.6_(markt)

MFH:	2025Q2
fd0909f162
Vladimir Druzenko (vvd) · 11.0.5
www/tomcat-devel: Update 11.0.4 → 11.0.5

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.5_(markt)

MFH:	2025Q1
ec8c485c89
Vladimir Druzenko (vvd) · 11.0.4
www/tomcat-devel: Update 11.0.3 => 11.0.4

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.4_(markt)

MFH:	2025Q1
932d2ee2f7
Vladimir Druzenko (vvd) · 11.0.3
www/tomcat-devel: Update 11.0.2 => 11.0.3

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.3_(markt)

MFH:	2025Q1
f7c4815987
Muhammad Moinur Rahman (bofh) · 11.0.2
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Vladimir Druzenko (vvd) · 11.0.2
www/tomcat-devel: Update 11.0.1 → 11.0.2

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.2_(markt)

MFH:	2024Q4
a7e82a1a9a
Vladimir Druzenko (vvd) · 11.0.1
www/tomcat-devel: Update 11.0.0 → 11.0.1

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.1_(markt)

MFH:	2024Q4
4a59c4ba18
Vladimir Druzenko (vvd) · 11.0.0
www/tomcat-devel: Update 11.0.0-M26 → 11.0.0

11.0 stable release. Keep this port for feature development releases.

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0_(markt)

MFH:	2024Q4
0215567cf5
Vladimir Druzenko (vvd) · 11.0.0.m26
www/tomcat-devel: Update 11.0.0-M25 → 11.0.0-M26

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M26_(markt)

MFH:	2024Q3
59a7e52d43
Vladimir Druzenko (vvd) · 11.0.0.m25
www/tomcat-devel: Update 11.0.0-M24 → 11.0.0-M25

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M25_(markt)

MFH:	2024Q3
663203e9f2
Vladimir Druzenko (vvd) · 11.0.0.m24
www/tomcat-devel: update 11.0.0-M22 → 11.0.0-M24

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M24_(markt)

MFH:	2024Q3
73d80d0356
Vladimir Druzenko (vvd) · 11.0.0.m22
www/tomcat-devel: update 11.0.0-M21 → 11.0.0-M22

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M22_(markt)

MFH:	2024Q3
16d3d1a630
Vladimir Druzenko (vvd) · 11.0.0.m21
www/tomcat-devel: update 11.0.0-M20 → 11.0.0-M21

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M21_(markt)

MFH:	2024Q2
70ffe82e6c
Vladimir Druzenko (vvd) · 11.0.0.m20
www/tomcat-devel: update to 11.0.0-M20

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M20_(markt)

MFH:	2024Q2
291556cc52
Vladimir Druzenko (vvd) · 11.0.0.m19
www/tomcat-devel: update to 11.0.0-M19

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M19_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q2
de9f372ec9
Vladimir Druzenko (vvd) · 11.0.0.m18
*/*: remove GNU_CONFIGURE_MANPREFIX and pet the portclippy

Approved by:	arrowd (mentor)
43757efeb9
Vladimir Druzenko (vvd) · 11.0.0.m18
www/tomcat-devel: update description

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
136d6c07ed
Vladimir Druzenko (vvd) · 11.0.0.m18
www/tomcat-devel: update to 11.0.0-M18

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M18_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
e487ad54d3
Vladimir Druzenko (vvd) · 11.0.0.m17
www/tomcat-devel: update to 11.0.0-M17

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M17_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
20b6d1fe21
Vladimir Druzenko (vvd) · 11.0.0.m16
www/tomcat-devel: update to 11.0.0-M16

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M16_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
f5182f6ace
Vladimir Druzenko (vvd) · 11.0.0.m15
www/tomcat-devel: update to 11.0.0-M15

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M15_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
e773b0382b
Vladimir Druzenko (vvd) · 11.0.0.m14
www/tomcat-devel: update to 11.0.0-M14

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M14_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
92d08c5e03
Vladimir Druzenko (vvd) · 11.0.0.m13
www/tomcat-devel: update to 11.0.0-M13

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M13_(markt)
- CVEs fixed: CVE-2023-41080 CVE-2023-42795 CVE-2023-44487 CVE-2023-45648
- Removed "endorsed" feature - Java since 9 doesn't support it and Tomcat 11
  required Java 21+ since 11.0.0-M7.

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
b45e850487
Vladimir Druzenko (vvd) · 11.0.0.m6
www/tomcat-devel: update to 11.0.0-M6

https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M6_(markt)

Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D40030
69b8869a06
Vladimir Druzenko (vvd) · 11.0.0.m5
*: Change MAINTAINER on my ports

Approved by: arrowd (mentor)
Differential Revision: https://reviews.freebsd.org/D39935
7caa9e5432
Vladimir Druzenko (vvd) · 11.0.0.m5
www/tomcat{85,9,101,-devel}: Update to 8.5.88, 9.0.74, 10.1.8, 11.0.0-M5

CVE-2023-24998 FileUpload DoS with excessive parts
ChangeLog:
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.88_(schultz)
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.74_(remm)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.8_(schultz)
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M5_(markt)

PR: 269652
Reported by: Vladimir Druzenko <vvd@FreeBSD.org>
Approved by: arrowd (mentor)
0932776313
Nuno Teixeira (eduardo) · 11.0.0.m1
www/tomcat{9,101,-devel}: Update to 9.0.70, 10.1.4, 11.0.0-M1

ChangeLog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.70_(remm)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.4_(markt)
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0-M1_(markt)

PR:		268280
b5f9ca9d84
Nuno Teixeira (eduardo) · 10.1.2
www/tomcat{9,101,-devel}: Update to 9.0.69, 10.1.2, 10.1.2

ChangeLog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.69_(remm)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.2_(markt)

PR:		267778
73e63bbeeb
page 1 of 2older →oldest »