CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

www/tomcat-native 1.3.9

Tomcat native library

0
unaddressed
0
VuXML only
3
fixed
0
open problem reports

Port info

Maintainer
michaelo@apache.org
Packages
latest: 1.3.9
Upstream
Higher version available: 2.0.17
Last update
to 1.3.9 · 787734d698
Quarterly
2026Q4: 1.3.9
WWW
https://tomcat.apache.org/native-1.3-doc/
Links
cgit · VuXML

Install

Package
# pkg install tomcat-native
installs 1.3.9 from latest; from quarterly (2026Q4) 1.3.9
Port
# cd /usr/ports/www/tomcat-native && make install clean
Size
60 KiB download · 193 KiB installed
Depends on
devel/apr1 1.7.6.1.6.3
License
APACHE20

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.3.91.3.9–
FreeBSD 151.3.91.3.9–
FreeBSD 141.3.91.3.91.3.9

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.3.91.3.9–
FreeBSD 141.3.91.3.91.3.9

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.3.9.

Fixed (3)

Show 3 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-862469.12026-09-23Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO…
CVE-2026-862437.52026-09-23Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache T…
CVE-2026-862477.42026-09-23Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. T…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (68)

Baptiste Daroussin (bapt) · 1.1.24
Decommissioning java 1.5 (EOLed since October 2009): suppress any reference to JAVA_VERSION=	1.5+ (part3)
9c526f7217
Alex Dupre (ale) · 1.1.24
Update to 1.1.24 release.

PR:		ports/169429
Submitted by:	jgh
926750f2dd
Alex Dupre (ale) · 1.1.23
Update to 1.1.23 release.

PR:		ports/165671
Submitted by:	jgh
8aa728fdbb
Thomas Abthorpe (tabthorpe) · 1.1.22
- The proper acronym for Apache Software License 2 is really AL2 - Thanks to crees@ for generating the initial patch

PR:		ports/163521
Submitted by:	Pedro Giffuni <pfg apache.org>
Hat:		portmgr
Exp run by:	pav
e0ac1afbf4
Doug Barton (dougb) · 1.1.22
Remove more tags from pkg-descr files fo the form:

- Name
em@i.l

or variations thereof. While I'm here also fix some whitespace and other
formatting errors, including moving WWW: to the last line in the file.
2b1dacc826
Alex Dupre (ale) · 1.1.22
Update to 1.1.22 release.

PR:		ports/159653
Submitted by:	Jason Helfman <jhelfman@experts-exchange.com>
0d5a516b63
Martin Wilke (miwi) · 1.1.20_2
- Get Rid MD5 support
a9481afc8a
Philip M. Gollucci (pgollucci) · 1.1.20_2
- Chase devel/apr -> devel/apr1 shuffling

PR:             ports/146553
Submitted by:   myself (pgollucci@)
With Hat:       apache@
61bcae45bc
Philip M. Gollucci (pgollucci) · 1.1.20_1
- Convert ports/ to devel/apr1

PR:             ports/146553
Submitted by:   myself (pgollucci@)
With Hat:       apache@
55544fc2be
Philip M. Gollucci (pgollucci) · 1.1.20_1
4/5: Chase devel/apr shlib bump

PR:             ports/146130
Approved by:    portmgr (pav)
Tested by:      -exp run (pav)
With Hat:       apache@
3a2084de1e
Philip M. Gollucci (pgollucci) · 1.1.20
3/5: Fix apr-1.3 libnames to be apr-1      PORTREVISION bumps comming next

PR:             ports/146130
Approved by:    portmgr (pav)
Tested by:      -exp run (pav)
With Hat:       apache@
bb992ed998
Alex Dupre (ale) · 1.1.20
Update to 1.1.20 release.

PR:		ports/144275
Submitted by:	wen
Feature safe:	yes
73710bf9ee
Alex Dupre (ale) · 1.1.18
Update to 1.1.18 release.
82f828120d
Alex Dupre (ale) · 1.1.16
Update to 1.1.16 release.
4408974e21
Alex Dupre (ale) · 1.1.15
Update to 1.1.15 release.
dde4e4e83f
Alex Dupre (ale) · 1.1.14
Update to 1.1.14 release.
54d87846f6
Edwin Groothuis (edwin) · 1.1.13_1
Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)
090059a210
Alex Dupre (ale) · 1.1.13
Tomcat can use the Apache Portable Runtime to provide superior scalability, performance, and better integration with native server technologies. APR has many uses, including access to advanced IO functionality (such as sendfile, epoll and OpenSSL), OS level functionality (random number generation, system status, etc), and native process handling (shared memory, NT pipes and Unix sockets).

These features allows making Tomcat a general purposewebserver, will
enable much better integration with other native web technologies, and
overall make Java much more viable as a full fledged webserver platform
rather than simply a backend focused technology.
504dfd7f7f
« newest← newerpage 2 of 2