CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

www/tomcat99.0.123

Open-source Java web server by Apache, 9.0.x branch

0
unaddressed
0
VuXML only, still affected
20
fixed
Maintainer
vvd@FreeBSD.org
Packages
tomcat9 9.0.123
Upstream
up to date
CPE
apache:tomcat from the port
WWW
https://tomcat.apache.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (20)

Show 20 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-656379.82026-08-25Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, fro…
CVE-2026-659059.82026-08-25Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST au…
CVE-2026-685259.12026-08-25Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resou…
CVE-2026-651829.12026-08-25Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before…
CVE-2026-651838.12026-08-25Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix d…
CVE-2026-664228.12026-08-25Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the…
CVE-2026-685698.12026-08-25Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user di…
CVE-2026-659277.52026-08-25Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the firs…
CVE-2026-687637.52026-08-25Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach…
CVE-2026-731806.82026-08-25Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection ha…
CVE-2026-662995.32026-07-28Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.…

Commits (113)

Vladimir Druzenko (vvd) · 9.0.123
www/tomcat9: Update 9.0.122 => 9.0.123

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.123_(remm)

Sponsored by:	UNIS Labs
MFH:		2026Q4
adfaab82dc
Vladimir Druzenko (vvd) · 9.0.122
www/tomcat9: Update 9.0.121 => 9.0.122

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.122_(remm)

Sponsored by:	UNIS Labs
MFH:		2026Q3
ad4f5e7dd7
Vladimir Druzenko (vvd) · 9.0.121
www/tomcat9: Update 9.0.120 => 9.0.121

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.121_(remm)

Sponsored by:	UNIS Labs
MFH:		2026Q3
86a455039c
Vladimir Druzenko (vvd) · 9.0.120
www/tomcat9: Update 9.0.118 => 9.0.120

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.120_(remm)

Sponsored by:	UNIS Labs
MFH:		2026Q2
71c298e5b1
Michael Osipov (michaelo) · 9.0.118_1
www/tomcat-{9,101,110,devel}: Pass -procname to jsvc

Commons Daemon 1.6.0 gained the capability to invoke setproctitle(2) like
daemon(8). Pass ${name} to -proctitle.

Approved by:	vvd (maintainer)
Differential Revision:	https://reviews.freebsd.org/D57621
8fbf299d6f
Vladimir Druzenko (vvd) · 9.0.118
www/tomcat9: Update 9.0.117 => 9.0.118

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.118_(remm)

Sponsored by:	UNIS Labs
MFH:		2026Q2
28d2f72739
Vladimir Druzenko (vvd) · 9.0.117
www/tomcat{-devel,101,110,9}: Improve ports (no functional changes)

Simplify MASTER_SITES and parametrize COMMENT.

Sponsored by:	UNIS Labs
462a109fd5
Vladimir Druzenko (vvd) · 9.0.117
www/tomcat9: Update 9.0.116 => 9.0.117

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.117_(remm)

Sponsored by:	UNIS Labs
MFH:		2026Q2
e5b595ef92
Ronald Klop (ronald) · 9.0.116_1
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Vladimir Druzenko (vvd) · 9.0.116
www/tomcat9: Update 9.0.115 => 9.0.116

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.116_(remm)

MFH:	2026Q1
78731db77f
Ronald Klop (ronald) · 9.0.115_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Vladimir Druzenko (vvd) · 9.0.115
www/tomcat9: Update 9.0.113 => 9.0.115

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.115_(remm)

MFH:	2026Q1
6971b14b68
Vladimir Druzenko (vvd) · 9.0.113
www/tomcat9: Update 9.0.112 => 9.0.113

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.113_(remm)

MFH:	2025Q4
81c312c5af
Vladimir Druzenko (vvd) · 9.0.112
www/tomcat9: Updaet 9.0.111 => 9.0.112

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.112_(remm)

MFH:	2025Q4
87eac050ff
Vladimir Druzenko (vvd) · 9.0.111
www/tomcat9: Update 9.0.110 => 9.0.111

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.111_(remm)

MFH:	2025Q4
c74bd12b34
Vladimir Druzenko (vvd) · 9.0.110
www/tomcat9: Update 9.0.109 => 9.0.110

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.110_(remm)

MFH:	2025Q4
29d080a920
Vladimir Druzenko (vvd) · 9.0.109
www/tomcat9: Update 9.0.108 => 9.0.109

Chagelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.109_(remm)

MFH:	2025Q3
004f726c8f
Vladimir Druzenko (vvd) · 9.0.108
www/tomcat9: Update 9.0.107 => 9.0.108

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.108_(remm)

Improve port.
Refresh patch.

MFH:	2025Q3
bae35af04e
Vladimir Druzenko (vvd) · 9.0.107
www/tomcat9: Update 9.0.106 => 9.0.107

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.107_(remm)

MFH:	2025Q3
00029458b7
Vladimir Druzenko (vvd) · 9.0.106
www/tomcat9: Update 9.0.105 => 9.0.106

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.106_(remm)

MFH:	2025Q2
35f9997c67
Vladimir Druzenko (vvd) · 9.0.105
www/tomcat9: Update 9.0.104 => 9.0.105

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.105_(remm)

MFH:	2025Q2
9a6beff911
Vladimir Druzenko (vvd) · 9.0.104_2
www/tomcat{9,101,110,-devel}: Improve apply JAVA 9+ specific start-up parameters

after update jsvc form port devel/apache-commons-daemon

PR:	286524
MFH:	2025Q2
e778c13459
Vladimir Druzenko (vvd) · 9.0.104_1
www/tomcat{9,101,110,-devel}: Add the JAVA 9+ specific start-up parameters required by Tomcat

Default startup script set these parameters.
Without them, some applications do not work.

MFH:	2025Q2
8b3af89e8e
Vladimir Druzenko (vvd) · 9.0.104
www/tomcat9: 9.0.102 => 9.0.104

Changelogs:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.104_(remm)

MFH:	2025Q2
2a14b640b6
Vladimir Druzenko (vvd) · 9.0.102
www/tomcat9: Update 9.0.100 → 9.0.102

Changelogs:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.102_(remm)

MFH:	2025Q1
67a66b196e
Vladimir Druzenko (vvd) · 9.0.100
www/tomcat9: Replace PORTVERSION with DISTVERSION
384b7b44f5
Vladimir Druzenko (vvd) · 9.0.100
www/tomcat9: Update 9.0.99 => 9.0.100

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.100_(remm)

MFH:	2025Q1
1c86058275
Vladimir Druzenko (vvd) · 9.0.99
www/tomcat9: Update 9.0.98 => 9.0.99

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.99_(remm)

MFH:	2025Q1
6606e3f06b
Muhammad Moinur Rahman (bofh) · 9.0.98
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Vladimir Druzenko (vvd) · 9.0.98
www/tomcat9: Update 9.0.98 → 9.0.99

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.98_(remm)

MFH:	2024Q4
f8314bac50
Vladimir Druzenko (vvd) · 9.0.97
www/tomcat9: Update 9.0.96 → 9.0.97

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.97_(remm)

MFH:	2024Q4
2d8e311699
Vladimir Druzenko (vvd) · 9.0.96
www/tomcat9: Update 9.0.95 → 9.0.96

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.96_(remm)

MFH:	2024Q4
b32d0693a6
Vladimir Druzenko (vvd) · 9.0.95
www/tomcat9: 9.0.94 → 9.0.95

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.95_(remm)

MFH:	2024Q3
db2663eccd
Vladimir Druzenko (vvd) · 9.0.94
www/tomcat9: 9.0.93 → 9.0.94

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.94_(remm)

MFH:	2024Q3
7d4f7529bf
Vladimir Druzenko (vvd) · 9.0.93
www/tomcat9: update 9.0.91 → 9.0.93

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.93_(remm)

MFH:	2024Q3
8eb64f1151
Vladimir Druzenko (vvd) · 9.0.91
www/tomcat9: update 9.0.90 → 9.0.91

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.91_(remm)

MFH:	2024Q3
1eaa6c1534
Vladimir Druzenko (vvd) · 9.0.90
www/tomcat9: update 9.0.89 → 9.0.90

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.90_(remm)

MFH:	2024Q2
3e65a40aa3
Vladimir Druzenko (vvd) · 9.0.89
www/tomcat9: update to 9.0.89

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.89_(remm)

MFH:	2024Q2
26dcbf5baa
Vladimir Druzenko (vvd) · 9.0.88
www/tomcat9: update to 9.0.88

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.88_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q2
33c0b070cc
Vladimir Druzenko (vvd) · 9.0.87
*/*: remove GNU_CONFIGURE_MANPREFIX and pet the portclippy

Approved by:	arrowd (mentor)
43757efeb9
Vladimir Druzenko (vvd) · 9.0.87
www/tomcat9: update to 9.0.87

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.87_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
41a920d105
Vladimir Druzenko (vvd) · 9.0.86
www/tomcat9: update to 9.0.86

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.86_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
928904f9c5
Vladimir Druzenko (vvd) · 9.0.85
www/tomcat9: update to 9.0.85

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.85_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2024Q1
c08ccc4e11
Vladimir Druzenko (vvd) · 9.0.84
www/tomcat9: update to 9.0.84

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.84_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
b74dc977ad
Vladimir Druzenko (vvd) · 9.0.83
www/tomcat9: update to 9.0.83

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.83_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
e12453459d
Vladimir Druzenko (vvd) · 9.0.82
www/tomcat{85,9,101}: adjust rc.d script to support Java versions 20+

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
2fdb6fb459
Vladimir Druzenko (vvd) · 9.0.82
www/tomcat9: update 9.0.82 (fix regressions)

Changelog:
- Correct a regression in 9.0.81 that broke the Tomcat JBDC connection pool.
- Correct a regression in 9.0.81 that broke HTTP compression.
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.82_(remm)

Reported by:	Eirik Øverby <eirik.overby@modirum.com> (via email)
Approved by:	arrowd (mentor, implicit)
MFH:		2023Q4
b269702f02
Vladimir Druzenko (vvd) · 9.0.81
www/tomcat9: update to 9.0.81

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.81_(remm)

Approved by:	arrowd (mentor, implicit)
96293c0299
Vladimir Druzenko (vvd) · 9.0.80
www/tomcat{85,9,101}: update to 8.5.93, 9.0.80, 10.1.13: "Fix for FORM authentication open redirect - CVE-2023-41080"

Changelogs:
https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.93_(markt)
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.80_(markt)
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.13_(markt)

Approved by:	arrowd (mentor, implicit)
Security:	CVE-2023-41080
9fb22c52ab
Vladimir Druzenko (vvd) · 9.0.79
www/tomcat9: update to 9.0.79

Changelog:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.79_(remm)

Approved by:	arrowd (mentor, implicit)
MFH:		2023Q3
2d2afe7ade
page 1 of 3older →oldest »