Apache Tomcat 11.0.9 + x64

The notable changes in this release are:
Increase the default for maxPartCount from 10 to 50. Update the documentation to provide more details on the memory requirements to support multi-part uploads while avoiding a denial of service risk.
Various improvements to HTTP/2
Fix JMX value for keepAliveCount on the endpoint. Also add the value of useVirtualThreads in JMX.

Catalina
Fix: Fix rename operation throwing an exception during the webapp migration process. (remm)

Catalina:
Update the RemoteIpValve and RemoteIpFilter so that calls to ServletRequest.getRemoteHost() are consistent with the return value of ServletRequest.getRemoteAddr() rather than always returning a value for the proxy.
Align the behaviour of ServletContext.getRealPath(String path) with the recent clarification from the Servlet specification project. If the path parameter does not start with / then Tomcat processes the call as if / is appended to the beginning of the provided path.
Ensure that the LoadBalancerDrainingValve uses the correct setting for the secure attribute for any session cookies it creates. Based on a pull request by Andreas Kurth.
Don't assume that the Upgrade header has been set on the HttpServletResponse before any call is made to HttpServletRequest.upgrade().
Ensure that values are not duplicated when manipulating the vary header. Based on a pull request by Fredrik Fall.
Coyote:
Ensure that the bytesSent metric is correctly updated when compression is enabled.
WebSocket:
Fix a potential file descriptor leak when WebSocket connections are attempted and fail. Patch provided by Maurizio Adami.
Web applications:
Correct a regression in the addition of the HTTP header security filter to the examples web application that prevented the Servlet examples that depend on the asynchronous API from functioning correctly.
Tribes:
Start all core threads when starting the receiver and dispatch interceptor.
Other:
Implement validation of changelog.xml file at build time.
Update: Update to Maven Ant Resolver Tasks 1.3.0.
Provide SHA-256 and SHA-512 checksums for files published via Maven.

The notable changes compared to 8.5.23 include:
Java 9 is fully supported
Fixed a number of HTTP/2 issues
Fixed numerous JASPIC issues with patches from Lazar
Updated the packaged version of the Tomcat Native Library to 1.2.16 to pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL 1.0.2m

Catalina:
Fix: 18500: Add limited support for wildcard host names and host aliases. Names of the form *.domainname are now permitted. Note that an exact host name match takes precedence over a wild card host name match. (markt)
Fix: 59813: Ensure that circular relations of the Class-Path attribute from JAR manifests will be processed correctly. (violetagg)
Fix: Ensure that reading the singleThreadModel attribute of a StandardWrapper via JMX does not trigger initialisation of the associated servlet. With some frameworks this can trigger an unexpected initialisation thread and if initilisation is not thread-safe the initialisation can then fail. (markt)
Fix: Compatibility with rewrite from httpd for non existing headers. (jfclere)
Fix: By default, treat paths used to obtain a request dispatcher as encoded. This behaviour can be changed per web application via the dispatchersUseEncodedPaths attribute of the Context. (markt)
Fix: 59839: Apply roleSearchAsUser to all nested searches in JNDIRealm. (fschumacher)
Fix: 59859: Fix resource leak in WebDAV servlet. Based on patch by Coty Sutherland. (fschumacher)
Add: Provide a mechanism that enables the container to check if a component (typically a web application) has been granted a given permission when running under a SecurityManager without the current execution stack having to have passed through the component. Use this new mechanism to extend SecurityManager protection to the system property replacement feature of the digester. (markt)
Add: When retrieving an object via a ResourceLink, ensure that the object obtained is of the expected type. (markt)
Fix: 59823: Ensure that JASPIC configuration is taken into account when calling HttpServletRequest.authenticate(). (markt)
Fix: 59824: Mark the RewriteValve as supporting async processing by default. (markt)
Fix: 59862: Allow nested jar files scanning to be filtered with the system property tomcat.util.scan.StandardJarScanFilter.jarsToSkip. Patch is provided by Terence Bandoian. (violetagg)
Fix: 59866: When scanning WEB-INF/classes for annotations, don't scan the contents of WEB-INF/classes/META-INF (if present) since classes will never be loaded from that location. (markt)
Fix: 59888: Correctly handle tabs and spaces in quoted version one cookies when using the Rfc6265CookieProcessor. (markt)
Fix: 59912: Fix an edge case in input stream handling where an IOException could be thrown when reading a POST body. (markt)
Fix: 59913: Correct a regression introduced with the support for the Servlet 4 HttpServletRequest.getMapping() API that caused the attributes for forwarded requests to be lost if requested from within a subsequent include. (markt)
Fix: 59966: Do not start the web application if the error page configuration in web.xml is invalid. (markt)
Fix: Switch the CGI servlet to the standard logging mechanism and remove support for the debug attribute. (markt)
Fix: 60012: Improvements in the log messages. Based on suggestions by Nemo Chen. (violetagg)
Fix: Changes to the allowLinking attribute of a StandardRoot instance now invalidate the cache if caching is enabled. (markt)
Add: Add a new initialisation parameter, envHttpHeaders, to the CGI Servlet to mitigate httpoxy (CVE-2016-5388) by default and to provide a mechanism that can be used to mitigate any future, similar issues. (markt)
Add: When adding and removing ResourceLinks dynamically, ensure that the global resource is only visible via the ResourceLinkFactory when it is meant to be. (markt)
Fix: 60008: When processing CORs requests, treat any origin with a URI scheme of file as a valid origin. (markt)
Fix: Improve handling of exceptions during a Lifecycle events triggered by a state transition. The exception is now caught and the component is now placed into the FAILED state. (markt)
Fix: 60013: Fix encoding issues when using the RewriteValve with UTF-8 query strings or UTF-8 redirect URLs. (markt)
Fix: 60022: Improve handling when a WAR file and/or the associated exploded directory are symlinked into the appBase. (markt)
Fix: Fix a file descriptor leak when reading the global web.xml. (markt)
Fix: Consistently decode URL patterns provided via web.xml using the encoding of the web.xml file where specified or UTF-8 where no explicit encoding is specified. (markt)
Fix: Make timing attacks against the Realm implementations harder. (schultz)
Fix: A number of the JRE memory leaks addressed by the JreMemoryLeakPreventionListener have been fixed in Java 9 so the associated protection is now disabled when running on Java 9 onwards. (markt)
Coyote:
Fix: Correct a regression in refactoring to enable injection of custom keystores that broke the automatic conversion of OpenSSL style PEM key and certificate files for use with JSSE TLS connectors. (markt)
Fix: 59910: Don't hardcode key alias value to "tomcat" for JSSE. When using a keystore, OpenSSL will still default to it. (remm)
Fix: 59904: Add a limit (default 200) for the number of cookies allowed per request. Based on a patch by gehui. (markt)
Fix: 59925: Correct regression in r1628368 and ensure that HTTP separators are handled as configured in the LegacyCookieProcessor. Patch provided by Kyohei Nakamura. (markt)
Fix: 59950: Correct log message when reporting that the current number of HTTP/2 streams for a connection could not be pruned to below the limit. (markt)
Fix: Ensure that Semaphore.release is called in all cases. Even when there is an exception. (violetagg)
Fix: 60030: Correct a potential infinite loop in the SNI parsing code triggered by failing to handle an end of stream condition. (markt)
Fix: Small logging optimization in the Rfc6265CookieProcessor. Patch provided by Svetlin Zarev. (markt)
Fix: OpenSSL now disables 3DES by default so reflect this when using OpenSSL syntax to select ciphers. (markt)
Fix: Use the proper ERROR socket status code for async errors with NIO2. (remm)
Fix: 60035: Fix a potential connection leak if the client drops a TLS connection before the handshake completes. (markt)
Fix: Refactor the JSSE client certificate validation so that the effectiveness of the certificateVerificationDepth configuration attribute does not depend on the presence of a certificate revokation list. (markt)
Add: Log a warning at start up if a JSSE TLS connector is configured with a trusted certificate that is either not yet valid or has expired. (markt)
Jasper:
Fix: When writing out a full web.xml file with JspC ensure that the encoding used in the XML prolog matches the encoding used to write the contents of the file. (markt)
Fix: Improve the error handling for custom tags to ensure that the tag is returned to the pool or released and destroyed once used. (markt)
Fix: 60032: Fix handling of method calls that use varargs within EL value expressions. (markt)
Fix: Ignore engineOptionsClass and scratchdir when running under a security manager. (markt)
Fix: Fixed StringIndexOutOfBoundsException. Based on a patch provided by wuwen via Github. (violetagg)
WebSocket:
Fix: 59908: Ensure that a reason phrase is included in the close message if a session is closed due to a timeout. (markt)
Web applications:
Fix: 59867: Correct the documentation provided by Manager's 403.jsp. (violetagg)
Fix: 59868: Clarify the documentation for the Manager web application to make clearer that the host name and IP address in the server section are the primary host name and IP address. (markt)
Fix: 59940: Correct the name of the truststorePassword attribute of the SSLHostConfig element in the configuration documentation. (markt)
Fix: MBeans Descriptors How-To is moved to mbeans-descriptors-howto.html. Patch provided by Radoslav Husar. (violetagg)
Fix: Update NIO Connector configuration documentation with an information about socket.directSslBuffer. (violetagg)
Fix: 60034: Correct a typo in the Manager How-To page of the documentation web application. (markt)
jdbc-pool:
Fix: In order to avoid the unintended skip of PoolCleaner, remove the check code of the execution interval in the task that has been scheduled. (kfujino)
Fix: 59850: Ensure that the ResultSet is closed when enabling the StatementCache interceptor. (kfujino)
Fix: 59923: Reduce the default value of validationInterval in order to avoid the potential issue that continues to return an invalid connection after database restart. (kfujino)
Fix: Ensure that the ResultSet is returned as Proxy object when enabling the StatementDecoratorInterceptor. (kfujino)
Fix: 60043: Ensure that the suspectTimeout works without removing connection when the removeAbandoned is disabled. (kfujino)
Fix: Add log message of when returning the connection that has been marked suspect. (kfujino)
Fix: Correct Javadoc for ConnectionPool.suspect(). Based on a patch by Yahya Cahyadi. (markt)
Other:
Add: 59871: Add a property (timeFormat) to JULI's OneLineFormatter to enable the format of the time stamp used in log messages to be configured. (markt)
Fix: 59899: Update Tomcat's copy of the Java Persistence annotations to include the changes made in 2.1 / JavaEE 7. (markt)
Fix: Fixed typos in mbeans-descriptors.xml files. (violetagg)
Update: Update the internal fork of Commons BCEL to r1757132 to align with the BCEL 6 release. (markt)
Update: Update the internal fork of Commons DBCP2 to r1757164 to pick up a couple of bug fixes. (markt)
Update: Update the internal fork of Commons Codec to r1757174. Code formatting changes only. (markt)
Update: Update the internal fork of Commons FileUpload to afdedc9. This pulls in a fix to improve the performance with large multipart boundaries. (markt)

Catalina:
Fix: 34319: Only load those keys in StoreBase.processExpire from JDBCStore, that are old enough, to be expired. Based on a patch by Tom Anderson. (fschumacher)
Add: 56917: As per RFC7231 (HTTP/1.1), allow HTTP/1.1 and later redirects to use relative URIs. This is controlled by a new attribute useRelativeRedirects on the Context and defaults to true. (markt)
Fix: 58629: Allow an embedded Tomcat instance to start when the Service has no Engine configured. (markt)
Fix: 58635: Enable break points to be set within agent code when running Tomcat with a Java agent. Based on a patch by Huxing Zhang. (markt)
Fix: 58660: Correct a regression in 8.0.29 caused by the change that moved the redirection for context roots from the Mapper to the Default Servlet. (markt)
Fix: Fixed potential NPE in HostConfig while deploying an application. Issue reported by coverity scan. (violetagg)
Fix: 58655: Fix an IllegalStateException when calling HttpServletResponse.sendRedirect() with the RemoteIpFilter. This was caused by trying to correctly generate the absolute URI for the redirect. With the fix for 56917, redirects may now be relative making the sendRedirect() implementation for the RemoteIpFilter much simpler. This also addresses issues where the redirect may not have behaved as expected when redirecting from http to https to from https to http. (markt)
Fix: 58657: Exceptions in a Servlet 3.1 ReadListener or WriteListener do not need to be immediately fatal to the connection. Allow an error response to be written. (markt)
Coyote:
Fix: Improve upgrade context classloader handling by using Context.bind and unbind. (remm)
Jasper:
Fix: 57136#c25: Change default value of quoteAttributeEL setting in Jasper to be true for better compatibility with other implementations and older versions of Tomcat (8.0.26/7.0.64 and earlier). Add command line option -no-quoteAttributeEL in JspC. (kkolinko)
Cluster:
Fix: Fix potential integer overflow in DeltaSession. Reported by coverity scan. (fschumacher)
WebSocket:
Add: 55006: The WebSocket client now honors the java.net.java.net.ProxySelector configuration (using the HTTP type) when establishing WebSocket connections to servers. Based on a patch by Niki Dokovski. (markt)
Fix: 58624: Correct a thread safety issue that meant that blocking message writes could block indefinitely if the WebSocket connection was closed while a message write was in progress. (markt)
Web Applications:
Fix: 58631: Correct the continuation character use in the Windows Service How-To page of the documentation web application. (markt)
Tribes:
Fix: Ensure that the static member is registered to the add suspect list even if the static member that is registered to the remove suspect list has disappeared. (kfujino)
Fix: Correct the warning log of when the member that is not registered in the membership is detected. (kfujino)
Fix: When using a static cluster, add the members that have been cached in the membership service to the map members list in order to ensure that the map member is a static member. (kfujino)
jdbc-pool:
Fix: Correct evaluation of system property org.apache.tomcat.jdbc.pool.onlyAttemptCurrentClassLoader. It was basically ignored before. Reported by coverity scan. (fschumacher)
Fix: Fix potential integer overflow in ConnectionPool and PooledConnection. Reported by coverity scan. (fschumacher)
Other:
Update: Update optional Checkstyle library to 6.13. (kkolinko)

General

Update: 58596: Clarify the description in RUNNING.txt of how environment variables are used. (markt)
Catalina

Add: Extend the fix for 57136 to provide a JSP Servlet initialisation parameter per web application that controls whether or not EL in JSP attributes is processed as if it uses JSP attribute quoting. By default, EL does not use JSP attribute quoting. (markt)
Fix: 57799: InputStream.available() was causing an IO operation to occur even in blocking mode, which caused problems with NIO2. (remm)
Add: Extend the fix for 58228 to include ServletContext.getRealPath(). (markt)
Add: 58486: Protect against two further possible memory leaks associated with XML parsing. (markt)
Fix: 58490: Fixed NPE thrown when scanning for javax.servlet.ServletContainerInitializer in case the web application is not extracted. (violetagg)
Code: 58497: Make AbstractHttp11Processor easy to extend. (markt)
Fix: 58508: Escape role names when generating associated MBeans in case the role name contains characters not permitted in an MBean name. (markt)
Fix: 58518: Correct a regression in the fix for 56777 that added support for URIs in config file locations. File paths on Windows could previously be specified with \ or / as the separator. 56777 broke that. (markt)
Fix: 58519: Fix ISE thrown by web application classloader in some error conditions due to trying to call initCause() on a ClassNotFoundException which is not permitted. (markt)
Fix: 58534: Removed repeated conditional tests in o.a.tomcat.websocket.pojo.PojoMethodMapping and o.a.tomcat.util.net.AprEndpoint Patch provided by Anthony Whitford. (violetagg)
Fix: 58535: Use Collections.reverseOrder when a reverse ordering is needed. (violetagg)
Fix: 58537, 58546: Some of the inner classes in o.a.catalina.valves.ExtendedAccessLogValve and o.a.tomcat.util.net.SecureNio2Channel are made static. Patch provided by Anthony Whitford. (violetagg)
Fix: 58540: Removed unused code from o.a.catalina.connector.Request. Patch provided by Anthony Whitford. (violetagg)
Fix: 58541, 58544: It is more efficient to call Integer.toString(int) instead of Integer.valueOf(int).toString() when only a string representation of a primitive is needed. Based on a patch provided by Anthony Whitford. (violetagg)
Fix: 58541, 58547: It is more efficient to call valueOf(...) instead of Number constructor. Based on a patch provided by Anthony Whitford. (violetagg)
Fix: 58545: In some use cases it is more efficient to use Map.entrySet() instead of Map.keySet() Based on a patch provided by Anthony Whitford. (violetagg)
Fix: Ensure that ServletRequest.getContentLengthLong is used instead of ServletRequest.getContentLength for servlets and valves provided by Tomcat. The API is available since Servlet specification 3.1. (violetagg)
Add: Add a new RestCsrfPreventionFilter that provides basic CSRF protection for REST APIs. (violetagg)
Fix: 58578: Avoid NPE accessing cookies during access logging for request that had no context mapping. (remm)
Fix: Avoid UnsupportedOperationException when releasing an user-provided URLStreamHandlerFactory. Patch provided by Cristian Talau. (violetagg)
Fix: 58581: If a custom error page fails, fall back to the standard error page rather than throwing an NPE. Based on a patch by Huxing Zhang. (markt)
Fix: 58582: Combined realm should perform background processing on its sub-realms. Based upon a patch provided by Aidan. (schultz)
Fix: Handle the unlikely case where different versions of a web application are deployed with different session settings. (markt)
Add: Add a new Context option, enabled by default, that enables an additional check that a client provided session ID is in use in at least one other web application before allowing it to be used as the ID for a new session in the current web application. (markt)
Add: Add support for DIGEST authentication to the JNDIRealm. Based on a patch by Alexis Hassler. (markt)
Fix: 58603: Ensure that HttpServletRequest.getRequestURL() returns the correct value when using the RemoteIpFilter. (markt)
Fix: Ensure that in an embedded Tomcat the logging configuration is not lost during garbage collection. (violetagg)
Add: Move the functionality that provides redirects for context roots and directories where a trailing / is added from the Mapper to the DefaultServlet. This enables such requests to be processed by any configured Valves and Filters before the redirect is made. This behaviour is configurable via the mapperContextRootRedirectEnabled and mapperDirectoryRedirectEnabled attributes of the Context which may be used to restore the previous behaviour. (markt)
Coyote

Fix: Cancel pending blocking IO operation following a timeout in the NIO2 connector. (remm)
Fix: Add instance manager support for upgrade handlers, and set context class loader. (remm)
Update: Synchronize OpenSSL to JSSE cipher mapping to recent OpenSSL changes. In particular, TLSv1.0 is now an alias for those ciphers that require TLSv1 and will not work with SSLv3. TLSv1 remains an alias for SSLv3. (markt)
Jasper

Add: Deprecate the STRICT_QUOTE_ESCAPING system property and replace it with an initialisation parameter for the JSP Servlet. This enables per web application control of this configuration setting. (markt)
Cluster

Fix: Optimize the session lock range in DeltaManager.requestCompleted. (kfujino)
Fix: Enable an explicit configuration of local member in the static cluster membership. (kfujino)
Tribes

Code: Distinguish the handling of the shutdown payload and member verification clearly. When handling shutdown payload, verification completion message is not required. (kfujino)
Fix: When starting the StaticMembershipInterceptor, StaticMembershipInterceptor checks the required Interceptors. If the required Interceptor does not exist, it issues warning logs. (kfujino)
WebSocket

Fix: Use instance manager for server endpoint instances. (remm)
Web applications

Add: Make it clear in the documentation for the CGI servlet that the debug page is not considered secure and should not be used in production. (markt)
Fix: The domain attribute of StaticMember is not required but optional. (kfujino)
jdbc-pool

Fix: 58489: Correct QueryStatsComparator to hold up the general contract for Comparator. (fschumacher)
Fix: When creating a QueryStats object, ensure that maxQueries is checked. If maxQueries is a value less than or equal to 0, QueryStats are never created. (kfujino)
Other

Update: Update optional Checkstyle library to 6.12.1. (kkolinko)
Add: Add support for creating a FindBugs report when building Tomcat. It is disabled by default. (violetagg)

Catalina:
Add: Add support for the custom classpath protocol in URLs. It an be used anywhere Tomcat accepts a URL for a configuration parameter. (markt)
Fix: 56777: Allow file based configuration resources (user database, certificate revocation lists, keystores an dtrust stores) to be configured using URLs as well as files. (markt)
Fix: Perform null-checking on input and stored credentials in all Realms before passing credentials off to CredentialHandlers for matching. (schultz)
Coyote:
Update: Add the new ciphers from RFC6655 and RFC7251 to the OpenSSL to JSSE cipher mapping. (markt)
Update: Remove DES, RC2 and RC4 from DEFAULT for the OpenSSL to JSSE cipher mapping to align with the OpenSSL development branch. (markt)
Jasper:
Fix: Improve the error message when JSP parser encounters an error parsing an attribute value. (markt)
Web applications:
Update: 58474: Provide a reference to the differences between CATALINA_HOME and CATALINA_BASE in the sample application that is part of the documentation web application. (markt)
Extras:
Fix: Ensure JULI adapters does not include the LogFactoryImpl class. Patch provided by Benjamin Gandon. (markt)

Fix: 58187: Correct a regression in the fix for 57765 that meant that deployment of web applications deployed via the Manager application was delayed until the next execution of the automatic deployment background process. (markt)
Fix: 58284: Correctly implement session serialization so non-serializable attributes are skipped with a warning. Patch provided by Andrew Shore. (markt)
Fix: 58313: Fix concurrent access of encoders map when clearing encoders prior to switch to async. (markt)
Fix: 58320: Fix concurrent access of request attributes which is possible during asynchronous processing. (markt)
Fix: 58352: Always trigger a thread dump if Tomcat fails to stop gracefully from catalina.sh even if using -force. Patch provided by Alexandre Garnier. (markt)
Fix: 58368: Fix a rare data race in the code that obtains the ApplicationFilterFactory instance. (markt)
Fix: 58369: Fix a rare data race in the code that obtains the CookieProcessor for a StandardContext instance. (markt)
Fix: Ensure the JAASRealm uses the configured CredentialHandler. (markt)
Fix: 58372: Fix rare data races closed and suspended flags that could be triggered by async and/or comet processing. (markt)
Fix: 58373: Fix rare data race with the application event listeners for StandardContext. (markt)
Fix: 58374: Fix a rare data race in the AsyncContext implementation for access to the internal Tomcat request object to which it holds a reference. (markt)
Fix: 58380: Fix two rare data races in the standard session implementation on the flag that tracks if the session is new and on the field that tracks the maximum inactive period. (markt)
Fix: 58385: Fix a rare data race in the internal flag Tomcat uses to keep track of whether or not a request is being used for Comet processing. (markt)
Fix: 58394: Fix a rare data race in Mapper when adding or removing a host. (markt)
Fix: 58398: Fix a rare data race in LifecycleSupport. (markt)
Fix: 58412: Ensure that the AsyncFileHandler has the source class and method name available for logging. (fschumacher)
Fix: 58416: Correctly detect when a forced stop fails to stop Tomcat because the Tomcat process is waiting on some system call or is uninterruptible. (markt)
Fix: 58436: Fix some rare data races in JULI's ClassLoaderLogManager during shutdown. (markt)
Fix: 58845: Fix off-by one error in calculation of valid characters in a cookie domain. Patch provided by Thorsten Ehlers. (markt)
Coyote:
Fix: Correct some edge cases in RequestUtil.normalize(). (markt)
Fix: 58275: The IBM JREs accept cipher suite names starting with TLS_ or SSL_ but when listing the supported cipher suites only the SSL_ version is reported. This can break Tomcat's check that at least one requested cipher suite is supported. Tomcat now includes a work-around so either form of the cipher suite name can be used when running on an IBM JRE. (markt)
Fix: 58357: For reasons not currently understood when the APR/native connector is used with OpenSSL reads can return an error code when there is no apparent error. This was work-around for HTTP upgrade connections by treating this as EAGAIN. The same fix has now been applied to the standard HTTP connector. (markt)
Code: Minor clean-up in NIO2 SSL handshake code to address some theoretical concurrency issues. (markt)
Fix: 58367: Fix a rare data race in the code that obtains the reason phrase for a given HTTP response code. (markt)
Fix: 58370: Fix a rare data race in the connector shutdown code. (markt)
Fix: 58371: Fix a rare data race when accessing request URI in String form when switching from non-async to async due to early triggering of the gathering of request statistics. (markt)
Fix: 58375: Fix a rare data race on the internal flag Tomcat uses to mark a response as committed. (markt)
Fix: 58377: Fix a rare data race on the internal flag Tomcat uses to mark a request as using HTTP keep-alive when switching to asynchronous processing. (markt)
Fix: 58379: Fix a rare data race on the interal reference Tomcat retains to the socket when switching to asynchronous processing. (markt)
Fix: 58387: Fix a rare data race when closing Comet connections. (markt)
Fix: 58388: Fix a data race when determining if Comet processing is occurring on a container or non-container thread. (markt)
Fix: 58389: Fix a rare data race while shutting down the thread pools on Connector stop. (markt)
Code: Clean up use of error flag on socket wrapper prompted by 58390. (markt)
Code: Remove some unnecessary code from the NIO Poller and fix 58396 as a side-effect. (markt)
Fix: 57799: Remove useless sendfile check for NIO SSL. (remm)
Jasper:
Fix: 57136: Correct a regression in the previous fix for this issue. \${ should only an escape for ${ within an EL expression. Within a JSP page \$ should be an escape for $. The EL specification applies when parsing the expression delimited by ${ and }. Parsing of the delimiting ${ and } is the responsibility of the JSP specification. (markt)
Fix: 58296: Fix a memory leak in the JSP unloading feature that meant that using a value other than -1 for maxLoadedJsps triggered a memory leak once the limit was reached. (markt)
Fix: 58327: Cache the expression string for value expression literals since it is frequently used and may be expensive to evaluate. Patch provided by Andreas Kohn. (markt)
Fix: 58340: Improve error reporting for tag files packaged in JARs. (markt)
Fix: 58424: When parsing TLD files, allow whitespace around boolean configuration values. (schultz)
Fix: Fix a possible resource leak reported by coverity scan. (fschumacher)
Fix: 58427: Enforce the JSP specification defined limitations of which elements are allowed in an implicit.tld file. (markt)
Fix: 58444: Ensure that JSPs work with any custom base class that meets the requirements defined in the JSP specification without requiring that base class to implement Tomcat specific code. (markt)
Cluster:
Fix: Fix a default clusterListeners in SimpleTcpCluster. The optimal default value is different for each session manager. ClusterSessionListener is never used in BackupManager. (kfujino)
Fix: Correct log messages in case of using BackupManager. (kfujino)
WebSocket:
Fix: 58342: Fix a copy and paste error that meant MessageHandler removal could fail for binary and pong MessageHandlers. Patch provided by DJ. (markt)
Fix: Data races detected by RV-Predict, mostly caused by completion handlers running in separate threads. (markt)
Fix: 58414: Correctly handle sending zero length messages when using per message deflate. (markt)
Web applications:
Fix: Correct documentation for cluster-howto. (kfujino)
Fix: Add missing documentation for property alwaysAddExpires for the LegacyCookieProcessor. (markt)
Tribes:
Add: Add support for configurations of ChannelListener and MembershipListener in server.xml. (kfujino)
Fix: Correct log messages in case of using ReplicatedMap. (kfujino)
Fix: 58381: Fix a rare data race in the NioReceiver. (markt)
Fix: 58382: Fix multiple rare data races in the default membership implementation. (markt)
Fix: 58383: Fix a data race in SenderState. (markt)
Fix: 58386: Fix a data race in ObjectReader. (markt)
Fix: 58391: Fix multiple data races in NonBlockingCoordinator, most of which were associated with ensuring that log messages contained the correct information. (markt)
Fix: 58392: Fix a data race in DomainFilterInterceptor. (markt)
Fix: 58393: Fix a data race on the listener in McastService. (markt)
Fix: 58395: Fix multiple data races in MemberImpl that were likely to cause issues if certain properties were updated concurrently (such updates are unlikely in normal usage). (markt)
Code: Remove some unnecessary code from PooledParallelSender and fix 58397. (markt)
jdbc-pool:
Fix: Make sure the pool has been properly configured when attributes that related to the pool size are changed via JMX. (kfujino)
Other:
Fix: Ensure logging works for all tests in a class rather than just the first one executed. (markt)
Add: 58344: Add build properties to enable tests to be executed against alternative binaries. Based on a patch by Petr Sumbera. (markt)

Web applications:
Add: 58255: Document the Semaphore valve

Catalina:
Fix: 57938: Correctly handle empty form fields when a form is submitted as multipart/form-data, the maxPostSize attribute of the Connector has been set to a negative value and the Context has been configured with a value of true for allowCasualMultipartParsing. The meaning of the value zero for the maxPostSize has also been changed to mean a limit of zero rather than no limit to align it with maxSavePostSize and to be more intuitive.
Add: 57939: Catch and log exceptions thrown by LifecycleListener implementations to prevent them from stopping the execution of subsequent LifecycleListeners.
Fix: 57977: Correctly bind and unbind the web application class loader during execution of the PersistentValve.
Fix: Remove some unnecessary code from the web application class loader and deprecate the now unused validate() method since the requirements of SRV.10.7.2 are met using cleaner code in loadClass(String, boolean) and filter().
Fix: Correct a bug that prevented the web application class loader's filter() from working correctly. It only returned true for classes in sub-packages of the listed packages, but not classes located in the packages themselves.
Fix: Add the WebSocket API classes to the list of classes that the web application class loader will always delegate to its parent for loading first.
Fix: 58015: Ensure that whenever the web application class loader checks to see if it should delegate first, it also checks the result of the filter() method which may indicate that it should always delegate first for the current class/resource regardless of the value of the delegate configuration option.
Fix: 58023: Fix potentially excessive memory usage due to unnecessary caching of JAR manifests in the web application class loader.
Fix: 57700: Ensure that Container event ADD_CHILD_EVENT will be sent in all cases.
Fix: 58086: Ensure that WAR URLs are handled properly when using ANT for web application deployment. Based on a patch provided by Lukasz Jader.
Fix: Fix CredentialHandler element handling in storeconfig.
Coyote:
Fix: 57265: Further fix to address a potential threading issue when sendfile is used in conjunction with TLS.
Fix: 57936: Improve robustness of the acceptor thread count parameter for NIO2, since it must be set to 1. Submitted by Oliver Kant.
Add: 57943: Added a work-around to catch ConcurrentModificationExceptions during Poller timeout processing that were causing the Poller thread to stop. The root cause of these exceptions is currently unknown.
Fix: 57944: Ensure that if non-blocking I/O listeners are set on a non-container thread that the expected listener events are still triggered.
Fix: Fix possible very long (1000 seconds) timeout with APR/native connector.
Add: Support "-" separator in the SSLProtocol configuration of the APR/native connector for protocol exclusion. (rjung)
Fix: 58004: Fix AJP buffering output data even in blocking mode.
WebSocket:
Fix: 57969: Provide path parameters to POJO via per session javax.websocket.server.ServerEndpointConfig as they vary between different requests.
Fix: 57974: Session.getOpenSessions should return all sessions associated with a given endpoint instance, rather than all sessions from the endpoint class.
Web applications:
Fix: 57282: Update request processing sequence diagrams.
Fix: 57971: Correct the documentation for the cluster configuration setting recoverySleepTime.
Add: 57758: Add document of testOnConnect attribute in jdbc-pool doc.
Add: Add description of validatorClassName attribute to testXXXX attributes in jdbc-pool docs.
Tribes:
Code: Use StringManager to provide i18n support in the org.apache.catalina.tribes packages.
Fix: Do not set the nodes that failed to replication to the backup nodes. Ensure that the nodes that the data has been successfully replicated are set to the backup node.
Fix: When failed to replication, rather than all member is handled as a failed member, exclude the failure members from backup members.
jdbc-pool:
Fix: Refactoring of the removeOldest method in SlowQueryReport to behave as expected.
Fix: 57783: Fix NullPointerException in SlowQueryReport. To avoid this NPE, Refactor SlowQueryReport#removeOldest and handle the abandoned connection properly.
Fix: 58042: In SlowQueryReportJmx, the LogSlow and logFailed attributes that inherited from SlowQueryReport are used as a condition of whether JMX notifications are sent.
Fix: Ensure that specified Boolean attribute values of SlowQueryReport reflect correctly. The LogSlow and the logFailed are not system property, these are attributes of SlowQueryReport.
Other:
Update: Update package renamed Apache Commons BCEL to r1682271 to pick up some some code clean up.
Update: Update package renamed Apache Commons DBCP to r1682314 to pick up the DBCP 2.1 release and additional fixes since then.
Update: Update package renamed Apache Commons Pool to the 2.4 release.
Update: Update package renamed Apache Commons File upload to r1682322 to pick up the post 1.3.1 fixes.
Update: Update package renamed Apache Commons Codes to r1682326. No functional changes. Javadoc only.
Update: Update optional Checkstyle library to 6.7.

Catalina
Fix: 57736: Change the format of the Tomcat specific URLs for resources inside JARs that are in turn packed in a WAR. The ^/ sequence has been replaced by */ so that the resulting URLs are compliant with RFC 2396 and do not trigger exceptions when converted to URIs. The old format will continue to be accepted. (markt)
Fix: 57752: Exclude non-cached resources from the Cache statistics for resource lookups. Patch provided by Adam Mlodzinski. (markt)
Add: Allow logging of the remote port in the access log using the format pattern %{remote}p. (rjung)
Fix: 57556: Refine the previous fix fo rthis issue so that the real path returned only has a trialing separator if the requested path ended with /. (markt)
Fix: 57765: When checking last modified times as part of the automatic deployment process, account for the fact that File.lastModified() has a resolution of one second to ensure that if a file has been modified within the last second, the latest version of the file is always used. Note that a side-effect of this change is that files with modification times in the future are treated as if they are unmodified. (markt)
Fix: Align redeploy resource modification checking with reload modification checking so that now, in both cases, a change in modification time rather than an increase in modification time is used to determine if the resource has changed. (markt)
Fix: Cleanup o.a.tomcat.util.digester.Digester from debug messages that do not give any valuable information. Patch provided by Polina Genova. (violetagg)
Fix: 57772: When reloading a web application and a directory representing an expanded WAR needs to be deleted, delete the directory after the web application has been stopped rather than before to avoid potential ClassNotFoundExceptions. (markt)
Fix: Fix wrong logger name of org.apache.catalina.webresources.StandardRoot. (kfujino)
Fix: 57801: Improve the error message in the start script in case the PID read from the PID file is already owned by a process. (rjung)
Fix: 57841: Improve error logging during web application start.
Fix: 57856: Ensure that any scheme/port changes implemented by the RemoteIpFilter also affect HttpServletResponse.sendRedirect().
Fix: 57863: Fix the RewriteMap support in RewriteValve that did not use the correct key value to look up entries.
Coyote:
Fix: 57779: When an I/O error occurs on a non-container thread only dispatch to a container thread to handle the error if using Servlet 3+ asynchronous processing. This avoids potential deadlocks if an application is performing I/O on a non-container thread without using the Servlet 3+ asynchronous API.
Code: Remove the experimental support for SPDY. No current user agent supports the version of SPDY that the experiment targetted. Note: HTTP/2 support is under development for Tomcat 9 and may be back-ported to Tomcat 8 once complete.
Fix: Possible incomplete writes with SSL NIO2.
Fix: Incorrect reads with SSL NIO2 caused by a bad strategy for handling IO differences between NIO and NIO2 that don't seem to be justified.
Fix: After some errors, the pending flags could remain set when using SSL NIO2.
Fix: 57833: When using JKS based keystores for NIO or NIO2, ensure that the key alias is always converted to lower caes since that is what JKS key stores expect. Based on a patch by Santosh Giri Govind M.
Fix: 57837: Add text/css to the default list of compressable MIME types.
Jasper:
Fix: 57845: Ensure that, if the same JSP is accessed directly and via a declaration in web.xml, updates to the JSP are visible (subject to the normal rules on re-compilation) regardless of how the JSP is accessed.
Fix: 57855: Explicitly handle the case where a MethodExpression is invoked with null or the wrong number of parameters. Rather than failing with an ArrayIndexOutOfBoundsException or a NullPointerException throw an IllegalArgumentException with a useful error message.
Cluster:
Fix: Avoid unnecessary call of DeltaRequest.addSessionListener() in non-primary nodes.
Add: Add new attribute that send all actions for session across Tomcat cluster nodes.
Fix: Remove unused pathname attribute in mbean definition of BackupManager.
WebSocket:
Fix: 57761: Ensure that the opening HTTP request is correctly formatted when the WebSocket client connects to a server root.
Fix: 57762: Ensure that the WebSocket client correctly detects when the connection to the server is dropped.
Fix: 57776: Revert the 8.0.21 fix for the permessage-deflate implementation and incorrect op-codes since the fix was unnecessary (the bug only affected trunk) and the fix broke rather than fixed permessage-deflate if an uncompressed message was converted into more than one compressed message.
Fix: Fix log name typo in WsRemoteEndpointImplServer class, caused by a copy-paste.
Fix: 57788: Avoid NPE when looking up a class hierarchy without finding anything.
Web applications:
Add: 57759: Add information to the keyAlias documentation to make it clear that the order keys are read from the keystore is implementation dependent.
Fix: 57864: Update the documentation web application to make it clearer that hex values are not valid for cluster send options. Based on a patch by Kyohei Nakamura.
Tribes:
Fix: Fix a concurrency issue when a backup message that has all session data and a backup message that has diff data are processing at the same time. This fix ensures that MapOwner is set to ReplicatedMapEntry.
Other:
Fix: Add missing pom for tomcat-storeconfig.
Update: Update optional Checkstyle library to 6.5.
Fix: 57707: Improve error message when trying to run a release build on a non-Windows platform and Wine is not available.

Catalina:

Add: 49785: Enable StartTLS connections for JNDIRealm.
Fix: When docBase refers internal war and unpackWARs is set to false, avoid registration of the invalid redeploy resource that has been added ".war" extension in duplicate.
Fix: If WAR exists, it is not necessary to trigger a reload when adding a Directory.
Fix: 55988: Add support for Java 8 JSSE server-preferred TLS cipher suite ordering. This feature requires Java 8.
Fix: 56608: When deploying an external WAR, add watched resources in the expanded directory based on whether the expanded directory is expected to exist rather than if it does exist.
Fix: When triggering a reload due to a modified watched resource, ensure that multiple changed watched resources only trigger one reload rather than a series of reloads.
Fix: 57601: Ensure that HEAD requests return the correct content length (i.e. the same as for a GET) when the requested resource includes a resource served by the Default servlet.
Fix: 57602: Ensure that HEAD requests return the correct content length (i.e. the same as for a GET) when the requested resource includes a resource served by a servlet that extends HttpServlet.
Fix: 57621: When an async request completes, ensure that any remaining request body data is swallowed.
Fix: 57637: Do not create unnecessary sessions when using PersistentValve.
Fix: 57645: Correct a regression in the fix for 57190 that incorrectly required the path passed to ServletContext.getContext(String) to be an exact match to a path to an existing context.
Fix: Make sure that unpackWAR attribute of Context is handled correctly in HostConfig.
Fix: When deploying a WAR file that contains a context.xml file and unpackWARs is false ignore any context.xml file that may exist in an expanded directory associated with the WAR.
Fix: 57675: Correctly quote strings when using the extended access log.
Add: Enable Tomcat to detect when a WAR file has been changed while Tomcat is not running. Tomcat does this by adding a META-INF/war-tracking file to the expanded directory and setting the last modified time of this file to the last modified time of the WAR. If Tomcat detects a modified WAR via this mechanism the web application will be redeployed (i.e. the expanded directory will be removed and the modified WAR expanded in its place).
Fix: 57704: Fix potential NPEs during web application start/stop when org.apache.tomcat.InstanceManager is not initialized.
Add: Use the simplified digest output for digest.bat|sh when generating digests with no salt and a single iteration to make it easier to use with DIGEST authentication.
Fix: Add support for LAST_ACCESS_AT_START system property to SingleSignOn.
Code: Refactor Authenticator implementations to reduce code duplication.
Fix: 57724: Handle the case in the CORS filter where a user agent includes an origin header for a non-CORS request.
Fix: When searching for SCIs o.a.catalina.Context.getParentClassLoader will be used instead of java.lang.ClassLoader.getParent. Thus one can provide the correct parent class loader when running embedded Tomcat in other environments such as OSGi.
Fix: 57743: Fix a locked file / resource leak issue when a JAR is accessed just before or during web application undeploy.

Coyote:

Add: 57540: Make TLS/SSL protocol available in a new request attribute (org.apache.tomcat.util.net.secure_protocol_version). (Note that AJP connectors will require mod_jk 1.2.41 or later, or an as-yet-unknown version of mod_proxy_ajp, or configure the proxy to send the AJP_SSL_PROTOCOL request attribute to Tomcat.)
Fix: Fix a cipher ordering issue when using the OpenSSL syntax for JSSE cipher configuration to ensure that ephemeral ECDH with AES is preferred to ephemeral ECDH with anything else.
Fix: 57570: Make the processing of trailer headers with chunked input optional and disabled by default.
Fix: 57592: Correctly handle the case where an AsyncContext is used for non-blocking I/O and is completed during a write operation.
Fix: 57638: Avoid an IllegalArgumentException when an AJP request body chunk larger than the socket read buffer is being read. This typically requires a larger than default AJP packetSize.
Fix: 57674: Avoid a BufferOverflowException when an AJP response body chunk larger than the socket write buffer is being written. This typically requires a larger than default AJP packetSize.
Update: Align the OpenSSL syntax cipher configuration with the OpenSSL 1.0.2 branch.
Fix: Numerous fixes to the APR/native connector to improve robustness.
Fix: Stop caching and re-using SocketWrapper instances. With the introduction of upgrade and non-blocking I/O, I/O can occur on non-container threads. This makes it nearly impossible to track whether a SocketWrapper is still being references or not. making re-use a risky proposition.
Code: Refactor Connector authentication (only used by AJP) into a separate method.
Add: 57708: Implement a new feature for AJP connectors - Tomcat Authorization. If the new tomcatAuthorization attribute is set to true (it is disabled by default) Tomcat will take an authenticated user name from the AJP protocol and use the appropriate Realm for the request to authorize (i.e. add roles) to that user.
Fix: Fix an issue that meant that any pipe-lined data read by Tomcat before an asynchronous request completed was lost during the completion of the asynchronous request. This mean that the pipe-lined request(s) would be lost and/or corrupted.
Update: Update the minimum recommended version of the Tomcat Native library (if used) to 1.1.33.

Jasper:

Fix: 57135: Package imports via javax.el.ImportHandler should only import public, concrete classes.
Fix: 57583: Cache 'Not Found' results in javax.el.ImportHandler.resolveClass() to save repeated attempts to load classes that are known not to exist to improve performance.
Fix: 57626: Correct a regression introduced in the 8.0.16 fix for ensuring Jars were closed after use, that broke recompilation of modified JSPs that depended on a tag file packaged in a Jar.
Fix: 57627: Correctly determine last modified times for dependencies when a tag file packaged in a JAR depends on a tag file packaged in a second JAR.
Fix: 57647: Ensure INFO message is logged when scanning jars for TLDs if the scan does not find a TLD in any jar. Previously a message would only be logged if a TLD was not found in all scanned jars.
Update: 57662: Update all references to the ECJ compiler to version 4.4.2.

Cluster:

Fix: Remove unnecessary method that always returns true. The domain filtering works on DomainFilterInterceptor.

WebSocket:

Fix: Correct a bug in the permessage-deflate implementation that meant that the incorrect op-codes were used if an uncompressed message was converted into more than one compressed message.
Add: 57676: List conflicting WebSocket endpoint classes when there is a path conflict.

Web applications:

Fix: 56058: Add links to the AccessLogValve documentation for configuring reverse proxies and/or Tomcat to ensure that the desired information is used entered in the access log when Tomcat is running behind a reverse proxy.
Fix: 57587: Update the JNDI Datasource HOWTO for DBCP2. Patch provided by Phil Steitz.
Fix: Remove incorrect note from context configuration page in the documentation web application that stated WAR files located outside the appBase were never unpacked.
Fix: 57683: Ensure that if a client aborts their connection to the stock ticker example (the only way a client can disconnect), the example continues to work for existing and new clients.
Fix: Make it clear that when using digested passwords with DIGEST authentication that no salt and only a single iteration must be used when generating the digest.
Update: Update examples to use Apache Standard Taglib 1.2.5.

Extras:

Fix: 57377: Remove the restriction that prevented the use of SSL when specifying a bind address with the JMXRemoteLifecycleListener. Also enable SSL to be configured for the registry as well as the server.

Tribes:

Fix: When a map member has been added to ReplicatedMap, make sure to add it to backup nodes list of all other members.
Fix: Make sure that refuse the messages from a different domain in DomainFilterInterceptor.

Other:

Update: Update optional Checkstyle library to 6.4.1.
Fix: 57703: Update the http-method definition for web applications using a Servlet 2.5 descriptor as per Servlet 2.5 MR 6.
Update: Update to Tomcat Native Library version 1.1.33 to pick up the Windows binaries that are based on OpenSSL 1.0.1m and APR 1.5.1.

Fix: Fix a concurrency issue that meant that a change in socket timeout (e.g. when switching to asynchronous I/O) did not always take effect immediately. (markt)

victor15, там всё элементарно...