security: upgrade Apache Tomcat from 9.0.113 to 9.0.118 (25.07.10 LTS backport)#35797
Open
mbiuki wants to merge 1 commit into
Open
security: upgrade Apache Tomcat from 9.0.113 to 9.0.118 (25.07.10 LTS backport)#35797mbiuki wants to merge 1 commit into
mbiuki wants to merge 1 commit into
Conversation
Backport of #35796 to the 25.07.10 LTS line. Fixes six published Apache Tomcat 9.x CVEs that affect 9.0.113: - CVE-2026-29146 (Important) — EncryptInterceptor padding oracle - CVE-2026-34500 (Moderate) — OCSP soft-fail with FFM - CVE-2026-34487 (Low) — Cloud membership exposes K8s bearer token - CVE-2026-34483 (Low) — Incomplete escaping of JSON access logs - CVE-2026-25854 (Low) — Occasional open redirect - CVE-2026-24880 (Low) — Request smuggling via invalid chunk extension Refs #35793
This was referenced May 21, 2026
mbiuki
added
QA: Note Included
OKR : Security & Privacy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport of #35796 to the 25.07.10 LTS line.
Bumps the bundled Apache Tomcat version from
9.0.113to9.0.118to resolve six published Apache Tomcat CVEs that affect 9.0.113.Refs #35793.
CVEs addressed
Source: https://tomcat.apache.org/security-9.html
Diff
Single-property change in
parent/pom.xml:The property propagates to BOM declarations,
dotCMS/pom.xml,dotcms-integration/pom.xml, and the docker descriptor — no source-code changes needed; Tomcat 9.0.x is API-stable across patch versions.Why this LTS backport is prioritized
Two enterprise customers blocked on this Tomcat version. The 25.07.10 LTS customer (Freshdesk ticket #37386) has an explicit deployment-blocking security gate. The 24.12.27 LTS backport (#TBD) and the evergreen PR (#35796) are tracked separately in #35793.
Test plan
tomcat:9.0.118-jdk11resolves and pulls cleanly25.07.10_lts_v10(or whichever the next revision is) artifact🤖 Generated with Claude Code