CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

www/tomcat10110.1.61

Open-source Java web server by Apache, 10.1.x branch

0
unaddressed
0
VuXML only, still affected
14
fixed
Maintainer
vvd@FreeBSD.org
Packages
tomcat101 10.1.61
Upstream
up to date
CPE
apache:tomcat from the port
WWW
https://tomcat.apache.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (14)

Show 14 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-656379.82026-08-25Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, fro…
CVE-2026-659059.82026-08-25Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST au…
CVE-2026-685259.12026-08-25Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resou…
CVE-2026-651829.12026-08-25Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before…
CVE-2026-651838.12026-08-25Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix d…
CVE-2026-664228.12026-08-25Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the…
CVE-2026-685698.12026-08-25Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user di…
CVE-2026-659277.52026-08-25Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the firs…
CVE-2026-687637.52026-08-25Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach…
CVE-2026-731806.82026-08-25Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection ha…
CVE-2026-662995.32026-07-28Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.…

Commits (57)

Vladimir Druzenko (vvd) · 10.1.61
www/tomcat101: Update 10.1.60 => 10.1.61

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.61_(schultz)

Sponsored by:	UNIS Labs
MFH:		2026Q4
cd01901c79
Vladimir Druzenko (vvd) · 10.1.60
www/tomcat101: Update 10.1.59 => 10.1.60

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.60_(schultz)

Sponsored by:	UNIS Labs
MFH:		2026Q3
88d3596b78
Vladimir Druzenko (vvd) · 10.1.59
www/tomcat101: Update 10.1.57 => 10.1.59

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.59_(schultz)

Sponsored by:	UNIS Labs
MFH:		2026Q3
1454b47854
Vladimir Druzenko (vvd) · 10.1.57
www/tomcat101: Update 10.1.55 => 10.1.57

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.57_(schultz)

Sponsored by:	UNIS Labs
MFH:		2026Q2
4336404d74
Michael Osipov (michaelo) · 10.1.55_1
www/tomcat-{9,101,110,devel}: Pass -procname to jsvc

Commons Daemon 1.6.0 gained the capability to invoke setproctitle(2) like
daemon(8). Pass ${name} to -proctitle.

Approved by:	vvd (maintainer)
Differential Revision:	https://reviews.freebsd.org/D57621
8fbf299d6f
Vladimir Druzenko (vvd) · 10.1.55
www/tomcat101: Update 10.1.54 => 10.1.55

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.55_(schultz)

Sponsored by:	UNIS Labs
MFH:		2026Q2
0c9fcf79d6
Vladimir Druzenko (vvd) · 10.1.54
www/tomcat{-devel,101,110,9}: Improve ports (no functional changes)

Simplify MASTER_SITES and parametrize COMMENT.

Sponsored by:	UNIS Labs
462a109fd5
Vladimir Druzenko (vvd) · 10.1.54
www/tomcat101: Update 10.1.53 => 10.1.54

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.54_(schultz)

Sponsored by:	UNIS Labs
MFH:		2026Q2
3506a61437
Ronald Klop (ronald) · 10.1.53_1
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Vladimir Druzenko (vvd) · 10.1.53
www/tomcat101: Update 10.1.52 => 10.1.53

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.53_(schultz)

MFH:	2026Q1
3cb47cf309
Ronald Klop (ronald) · 10.1.52_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Vladimir Druzenko (vvd) · 10.1.52
www/tomcat101: Update 10.1.50 => 10.1.52

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.52_(schultz)

MFH:	2026Q1
184d4ed0f3
Vladimir Druzenko (vvd) · 10.1.50
www/tomcat101: Update 10.1.49 => 10.1.50

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.50_(schultz)

MFH:	2025Q4
172b3dadd0
Vladimir Druzenko (vvd) · 10.1.49
www/tomcat101: Update 10.1.48 => 10.1.49

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.49_(schultz)

MFH:	2025Q4
e3a1bab676
Vladimir Druzenko (vvd) · 10.1.48
www/tomcat101: Update 10.1.47 => 10.1.48

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.48_(schultz)

MFH:	2025Q4
575b605073
Vladimir Druzenko (vvd) · 10.1.47
www/tomcat101: Update 10.1.46 => 10.1.47

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.47_(schultz)

MFH:	2025Q4
6d9231fe08
Vladimir Druzenko (vvd) · 10.1.46
www/tomcat101: Update 10.1.44 => 10.1.46

Changelogs:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.45_(schultz)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.46_(schultz)

MFH:	2025Q3
c69479d507
Vladimir Druzenko (vvd) · 10.1.44
www/tomcat110: Update 10.1.43 => 10.1.44

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.44_(schultz)

Improve port.
Refresh patch.

Security:	CVE-2022-45143
MFH:		2025Q3
a2ece296fd
Vladimir Druzenko (vvd) · 10.1.43
www/tomcat101: Update 10.1.42 => 10.1.43

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.43_(schultz)

MFH:	2025Q3
f0f530e0b3
Vladimir Druzenko (vvd) · 10.1.42
www/tomcat101: Update 10.1.41 => 10.1.42

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.42_(schultz)

MFH:	2025Q2
e16764bb34
Vladimir Druzenko (vvd) · 10.1.41
www/tomcat101: Update 10.1.40 => 10.1.41

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.41_(schultz)

MFH:	2025Q2
99adae85ee
Vladimir Druzenko (vvd) · 10.1.40_2
www/tomcat{9,101,110,-devel}: Improve apply JAVA 9+ specific start-up parameters

after update jsvc form port devel/apache-commons-daemon

PR:	286524
MFH:	2025Q2
e778c13459
Vladimir Druzenko (vvd) · 10.1.40_1
www/tomcat{9,101,110,-devel}: Add the JAVA 9+ specific start-up parameters required by Tomcat

Default startup script set these parameters.
Without them, some applications do not work.

MFH:	2025Q2
8b3af89e8e
Vladimir Druzenko (vvd) · 10.1.40
www/tomcat101: Update 10.1.39 => 10.1.40

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.40_(schultz)

MFH:	2025Q2
0b8e804fd6
Vladimir Druzenko (vvd) · 10.1.39
www/tomcat101: 10.1.36 → 10.1.39

Changelogs:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.39_(schultz)

MFH:	2025Q1
26bcbb0d73
Vladimir Druzenko (vvd) · 10.1.36
www/tomcat101: Update 10.1.35 => 10.1.36

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.36_(schultz)

MFH:	2025Q1
540c871a40
Vladimir Druzenko (vvd) · 10.1.35
www/tomcat101: Update 10.1.33 => 10.1.35

Changelogs:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.34_(schultz)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.35_(schultz)

MFH:	2025Q1
1c3ce46188
Muhammad Moinur Rahman (bofh) · 10.1.33
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Vladimir Druzenko (vvd) · 10.1.33
www/tomcat101: Update 10.1.31 → 10.1.33

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.33_(schultz)

MFH:	2024Q4
1860462bdb
Vladimir Druzenko (vvd) · 10.1.31
www/tomcat101: Update 10.1.30 → 10.1.31

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.31_(schultz)

MFH:	2024Q4
3cdd43cf46
Vladimir Druzenko (vvd) · 10.1.30
www/tomcat101: Update 10.1.29 → 10.1.30

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.30_(schultz)

MFH:	2024Q3
9436a1d889
Vladimir Druzenko (vvd) · 10.1.29
www/tomcat101: 10.1.28 → 10.1.29

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.29_(schultz)

MFH:	2024Q3
8ea6ea23ea
Vladimir Druzenko (vvd) · 10.1.28
www/tomcat101: update 10.1.26 → 10.1.28

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.28_(schultz)

MFH:	2024Q3
cc60cf5499
Vladimir Druzenko (vvd) · 10.1.26
www/tomcat101: update 10.1.25 → 10.1.26

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.26_(schultz)

MFH:	2024Q3
f0280c8317
Vladimir Druzenko (vvd) · 10.1.25
www/tomcat101: update 10.1.24 → 10.1.25

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.25_(schultz)

MFH:	2024Q2
03f4893411
Vladimir Druzenko (vvd) · 10.1.24
www/tomcat101: update to 10.1.24

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.24_(schultz)

MFH:	2024Q2
6f5c038aba
Vladimir Druzenko (vvd) · 10.1.23
www/tomcat101: update to 10.1.23

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.23_(schultz)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q2
989abc6e72
Vladimir Druzenko (vvd) · 10.1.20
*/*: remove GNU_CONFIGURE_MANPREFIX and pet the portclippy

Approved by:	arrowd (mentor)
43757efeb9
Vladimir Druzenko (vvd) · 10.1.20
www/tomcat101: update to 10.1.20

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.20_(schultz)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
e2c6f56193
Vladimir Druzenko (vvd) · 10.1.19
www/tomcat101: update to 10.1.19

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.19_(schultz)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
55a6939fe0
Vladimir Druzenko (vvd) · 10.1.18
www/tomcat101: update to 10.1.18

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.18_(schultz)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
ced22ccb85
Vladimir Druzenko (vvd) · 10.1.17
www/tomcat101: update to 10.1.17

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.17_(schultz)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
9a37fc1cc5
Vladimir Druzenko (vvd) · 10.1.16
www/tomcat101: update to 10.1.16

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.16_(schultz)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
d51dc4e944
Vladimir Druzenko (vvd) · 10.1.15
www/tomcat{85,9,101}: adjust rc.d script to support Java versions 20+

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
2fdb6fb459
Vladimir Druzenko (vvd) · 10.1.15
www/tomcat101: update to 10.1.15 (fix regressions)

Changelog:
- Correct a regression in 10.1.14 that broke the Tomcat JBDC connection pool
- Correct a regression in 10.1.14 that broke HTTP compression
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.15_(schultz)

Reported by:	Eirik Øverby <eirik.overby@modirum.com> (via email)
Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
db4a198875
Vladimir Druzenko (vvd) · 10.1.14
www/tomcat101: update to 10.1.14

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.14_(schultz)

Approved by:	arrowd (mentor, implicit)
e3ec78be97
Vladimir Druzenko (vvd) · 10.1.13
www/tomcat{85,9,101}: update to 8.5.93, 9.0.80, 10.1.13: "Fix for FORM authentication open redirect - CVE-2023-41080"

Changelogs:
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.93_(markt)
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.80_(markt)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.13_(markt)

Approved by:	arrowd (mentor, implicit)
Security:	CVE-2023-41080
9fb22c52ab
Vladimir Druzenko (vvd) · 10.1.12
www/tomcat101: update to 10.1.12

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.12_(markt)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q3
dd09019fe0
Vladimir Druzenko (vvd) · 10.1.11
www/tomcat101: update to 10.1.11

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.11_(schultz)

Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D40965
661d9239f1
Vladimir Druzenko (vvd) · 10.1.10
www/tomcat101: Updated to 10.1.10

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.10_(schultz)

Approved by:		adamw (mentor)
Differential Revision:	https://reviews.freebsd.org/D40503
f62bf01c43
page 1 of 2older →oldest »