CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

www/tomcat11011.0.27

Open-source Java web server by Apache, 11.0.x branch

0
unaddressed
0
VuXML only, still affected
13
fixed
Maintainer
vvd@FreeBSD.org
Packages
tomcat110 11.0.27
Upstream
up to date
CPE
apache:tomcat from the port
WWW
https://tomcat.apache.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (13)

Show 13 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-656379.82026-08-25Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, fro…
CVE-2026-659059.82026-08-25Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST au…
CVE-2026-685259.12026-08-25Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resou…
CVE-2026-651829.12026-08-25Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before…
CVE-2026-651838.12026-08-25Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix d…
CVE-2026-664228.12026-08-25Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the…
CVE-2026-685698.12026-08-25Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user di…
CVE-2026-659277.52026-08-25Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the firs…
CVE-2026-687637.52026-08-25Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach…
CVE-2026-731806.82026-08-25Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection ha…
CVE-2026-662995.32026-07-28Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.…

Commits (32)

Vladimir Druzenko (vvd) · 11.0.27
www/tomcat110: Update 11.0.26 => 11.0.27

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.27_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q4
649091be4c
Vladimir Druzenko (vvd) · 11.0.26
www/tomcat110: Update 11.0.25 => 11.0.26

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.26_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q3
64e45b06c0
Vladimir Druzenko (vvd) · 11.0.25
www/tomcat110: Update 11.0.24 => 11.0.25

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.25_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q3
b1d5ae18ac
Vladimir Druzenko (vvd) · 11.0.24
www/tomcat110: Update 11.0.22 => 11.0.24

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.24_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q2
e336702eb2
Michael Osipov (michaelo) · 11.0.22_1
www/tomcat-{9,101,110,devel}: Pass -procname to jsvc

Commons Daemon 1.6.0 gained the capability to invoke setproctitle(2) like
daemon(8). Pass ${name} to -proctitle.

Approved by:	vvd (maintainer)
Differential Revision:	https://reviews.freebsd.org/D57621
8fbf299d6f
Vladimir Druzenko (vvd) · 11.0.22
www/tomcat110: Update 11.0.21 => 11.0.22

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.22_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q2
eb3878ea4c
Vladimir Druzenko (vvd) · 11.0.21
www/tomcat{-devel,101,110,9}: Improve ports (no functional changes)

Simplify MASTER_SITES and parametrize COMMENT.

Sponsored by:	UNIS Labs
462a109fd5
Vladimir Druzenko (vvd) · 11.0.21
www/tomcat110: Update 11.0.20 => 11.0.21

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.21_(markt)

Sponsored by:	UNIS Labs
MFH:		2026Q2
55cc154815
Ronald Klop (ronald) · 11.0.20_1
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Vladimir Druzenko (vvd) · 11.0.20
www/tomcat110: Update 11.0.18 => 11.0.20

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.20_(markt)

MFH:	2026Q1
3a6e4af860
Ronald Klop (ronald) · 11.0.18_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Vladimir Druzenko (vvd) · 11.0.18
www/tomcat110: Update 11.0.15 => 11.0.18

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.18_(markt)

MFH:	2026Q1
ddce2457fd
Vladimir Druzenko (vvd) · 11.0.15
www/tomcat110: Update 11.0.14 => 11.0.15

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.15_(markt)

MFH:	2025Q4
1c459dadac
Vladimir Druzenko (vvd) · 11.0.14
www/tomcat110: Update 11.0.13 => 11.0.14

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.14_(markt)

MFH:	2025Q4
aeed210211
Vladimir Druzenko (vvd) · 11.0.13
www/tomcat110: Update 11.0.12 => 11.0.13

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.13_(mark)

MFH:	2025Q4
f4e6326e76
Vladimir Druzenko (vvd) · 11.0.12
www/tomcat110: Update 11.0.11 => 11.0.12

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.12_(markt)

MFH:	2025Q4
0f7372dc51
Vladimir Druzenko (vvd) · 11.0.11
www/tomcat110: Update 11.0.10 => 11.0.11

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.11_(markt)

MFH:	2025Q3
3383122bee
Vladimir Druzenko (vvd) · 11.0.10
www/tomcat110: Update 11.0.9 => 11.0.10

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.10_(markt)

Improve port.
Refresh patch.

MFH:	2025Q3
f2a2890320
Vladimir Druzenko (vvd) · 11.0.9
www/tomcat110: Update 11.0.7 => 11.0.8

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.8_(markt)

MFH:	2025Q3
3db74d4193
Vladimir Druzenko (vvd) · 11.0.8
www/tomcat110: Update 11.0.7 => 11.0.8

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.8_(markt)

MFH:	2025Q2
6b8e6b127e
Vladimir Druzenko (vvd) · 11.0.7
www/tomcat110: Update 11.0.6 => 11.0.7

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.7_(markt)

MFH:	2025Q2
1ddee78e66
Vladimir Druzenko (vvd) · 11.0.6_2
www/tomcat{9,101,110,-devel}: Improve apply JAVA 9+ specific start-up parameters

after update jsvc form port devel/apache-commons-daemon

PR:	286524
MFH:	2025Q2
e778c13459
Vladimir Druzenko (vvd) · 11.0.6_1
www/tomcat{9,101,110,-devel}: Add the JAVA 9+ specific start-up parameters required by Tomcat

Default startup script set these parameters.
Without them, some applications do not work.

MFH:	2025Q2
8b3af89e8e
Vladimir Druzenko (vvd) · 11.0.6
www/tomcat110: Udpate 11.0.5 => 11.0.6

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.6_(markt)

MFH:	2025Q2
8f5b7dc805
Vladimir Druzenko (vvd) · 11.0.5
www/tomcat110: Update 11.0.4 → 11.0.5

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.5_(markt)

MFH:	2025Q1
5de7e074ca
Vladimir Druzenko (vvd) · 11.0.4
www/tomcat110: Update 11.0.3 => 11.0.4

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.4_(markt)

MFH:	2025Q1
10b2e545fb
Vladimir Druzenko (vvd) · 11.0.3
www/tomcat110: Update 11.0.2 => 11.0.3

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.3_(markt)

MFH:	2025Q1
6f383ef044
Muhammad Moinur Rahman (bofh) · 11.0.2
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Vladimir Druzenko (vvd) · 11.0.2
www/tomcat110: Update 11.0.1 → 11.0.2

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.2_(markt)

MFH:	2024Q4
c271b50e85
Vladimir Druzenko (vvd) · 11.0.1
www/tomcat110: Update 11.0.0 → 11.0.1

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.1_(markt)

MFH:	2024Q4
1da255284a
Vladimir Druzenko (vvd) · 11.0.0
www/tomcat110: Necessary corrections after copying from www/tomcat-devel

Rename start script, PKGNAMESUFFIX, TOMCAT_SUBDIR.
91b69a8a09
Vladimir Druzenko (vvd) · 11.0.0
www/tomcat110: New port: Open-source Java web server by Apache, 11.0.x branch

Copy of port www/tomcat-devel.

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.0_(markt)
328c2fa97e