SUSE-SU-2026:4927-1

This update for libapr1, libtcnative-1-0, tomcat fixes the following issues:

• CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (bsc#1282631).
• CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
• CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
• CVE-2026-75973: improper authentication when Jakarta authentication is configured with SimpleAuthConfigProvider (bsc#1282630).
• CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
• CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy (bsc#1282628).
• CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).
• CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack (bsc#1282627).
• CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service (bsc#1282626).
• CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail (bsc#1282625).
• CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).
• CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket (bsc#1286902).
• CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623).
• CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
• CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621).
• CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled (bsc#1282620).
• CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).
• CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).
• CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).
• CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
• CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).
• CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362).

Non security issue fixed:

• Tomcat TLS Broken - Tomcat 9.0.14 update incompatible with tomcat-native (bsc#1130843).

Changes for libapr1:

Update to 1.6.5:

• Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4
• Fix apr_parse_addr_port() regression in scope_id parsing introduced in 1.6.3
• Numerous corrections to APR poll behavior
• apr_file_trunc: Truncating a buffered file could add unexpected data after the truncate position
• apr_file_trunc: Fix an issue where reading from a buffered file after truncate could return stale data from the buffer
• apr_ipsubnet_create() now fails for an empty input string
• Fix CVE-2017-12613, out-of-bounds read in apr_time_exp*()
• Export build files find_apr.m4 and apr_common.m4
• apr_proc_mutex-pthread: Refcount shared mutexes usage to avoid destruction while still in use by some process(es)
• New APIs: apr_allocator_align(), apr_os_proc_mutex_put_ex(), apr_os_proc_mutex_get_ex(), apr_os_proc_mutex_set_ex(), apr_file_pipe_create_pools(), apr_pollcb_wakeup(), apr_pollcb_method_name(), apr_cstr_(), apr_skiplist_addne(), apr_skiplist_size(), apr_skiplist_height(), apr_skiplist_preheight(), apr_skiplist_set_preheight(), apr_skiplist_add(), apr_sockaddr_info_copy(), apr_shm_delete(), apr_escape_ldap() and apr_pescape_ldap()
• Add APR_OVERLAP_TABLES_ADD, APR_SO_FREEBIND and the APR_PERMS_SET macros
• Add Unix domain socket support
• New configure options --enable-allocator-guard-pages and --enable-pool-concurrency-check

Changes for libtcnative-1-0:

• Update to 1.3.9

• Security fixes

• Client certificate requirements can be down-graded (bsc#1282621, CVE-2026-86247) A race condition allowed client certificate verification requirements to be down-graded for some configurations.
• Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246) Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
• DoS via TLS handshake (bsc#1282623, CVE-2026-86243) A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshaking permits a malicious user to trigger a DoS via a JVM crash.

• Changes

• Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x. ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4
• Fix: Fix a potential crash when negotiating ALPN
• If ALPN negotiation fails and failure is configured to use the last server protocol in the list, use it rather than the last protocol offered by the client
• Fix: Add support for the extended range of options available from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned int (represented by a Java long) rather than a 32-bit unsigned int (represented by a Java int)
• Code: Remove unused code
• Ensure that per connection changes to certificate verification settings, e.g. to support client certificate authentication, do not modify the certificate verification settings for other connections
• Fix: Fix a potential crash when configuring raw certificates
• Fix: Avoid a potential crash with very long ALPN protocol names
• Fix: Make the call to a CertificateVerifier more robust
• Fix: Avoid a potential crash when processing OCSP URLs
• Fix: Make the processing of OCSP responses more robust
• Fix: Stricter OCSP handling when soft-fail is disabled
• Fix: Harden against the mis-use of Buffer.address(ByteBuffer)
• Fix: Harden against the mis-use of Pool.destroy(long)
• Code: The minimum supported OpenSSL version is now 3.0.x. OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no bug reports were receive for that failure and since both Debian and Ubuntu versions that used OpenSSL 1.1.1 have reached end of support, OpenSSL 1.1.1 is no longer supported
• Update: OpenSSL 3.0.x is approaching end of support so the recommended version of OpenSSL (and the version that windows binaries will be built with) now follows the 3.5.x LTS branch
• Fix: Switch to automatic configuration of DH parameters. Manual configuration attempts will be ignored
• Code: Make setTmpECDHByCurveName() a NO-OP
• Fix: Refactor extraction of ECDH curve name from the Certificate to avoid deprecated OpenSSL methods
• Fix: Refactor the native implementation of SSL.getTime() to avoid the Y2038 problem in SSL_SESSION_get_time() when running on a verion of OpenSSL that includes the new SSL_SESSION_get_time_ex() method
• restore openssl 1.1.1 support

• Update to 1.3.8

• Fix a memory leak when parsing certificates
• Fix two potential memory leaks on error paths identified by Copilot
• Fix post handshake authentication when Tomcat is configured with a trust store using JSSE style configuration
• Correct expected size of tickets when calling SSLContext.setSessionTicketKeys

• Update to 1.3.7: [bsc#1260322] 1.3.7

• Code: Refactor access to ASN1_OCTET_STRING to use setters to fix errors when building against the latest OpenSSL 4.0.x code. (markt)
• Fix: Fix the handling of OCSP requests with multiple responder URIs. (jfclere)
• Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when soft fail is disabled. (jfclere) 1.3.6
• Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and SSL_CTX clean-up. (markt)
• Fix: Fix unnecessarily large buffer allocation when filtering out NULL and export ciphers. Pull requests #35 and #37 provided by chenjp. (markt)
• Fix: Fix a potential memory leak if an invalid OpenSSLConf is provided. Pull request #36 provided by chenjp. (markt)
• Fix: Refactor setting of OCSP configuration defaults as they were only applied if the SSL_CONF_CTX was used. While one was always used with Tomcat versions aware of the OCSP configuration options, one was not always used with Tomcat versions unaware of the OCSP configuration options leading to OCSP verification being enabled by default when the expected behaviour was disabled by default. (markt)
• Code: Improve performance for the rare case of handling large OCSP responses. (markt) 1.3.5
• Fix: Remove group write permissions from the files in the tar.gz source archive. (markt)
• Fix: Clear an additional error in OCSP processing that was preventing OCSP soft fail working with Tomcat's APR/native connector. (markt) 1.3.4
• Fix: Correct logic error that prevented the configuration of TLS 1.3 cipher suites. (markt) 1.3.3
• Fix: Refactor the addition of TLS 1.3 cipher suite configuration to avoid a regression when running a version of Tomcat that pre-dates this change. (markt) 1.3.2
• Update: Rename configure.in to modern autotools style configure.ac. (rjung)
• Update: Fix incomplete updates for autotools generated files during 'buildconf' execution. (rjung)
• Update: Improve quoting in tcnative.m4. (rjung)
• Update: Update the minimum version of autoconf for releasing to 2.68.
• Fix: Fix the autoconf warnings when creating a release. (markt)
• Update: The Windows binaries are now built with OCSP support enabled by default. (markt)
• Add: Include a nonce with OCSP requests and check the nonce, if any, in the OCSP response. (markt)
• Add: Expand verification of OCSP responses. (markt)
• Add: Add the ability to configure the OCSP checks to soft-fail - i.e. if the responder cannot be contacted or fails to respond in a timely manner the OCSP check will not fail. (markt)
• Add: Add a configurable timeout to the writing of OCSP requests and reading of OCSP responses. (markt)
• Add: Add the ability to control the OCSP verification flags. (markt)
• Add: Configure TLS 1.3 connections from the provided ciphers list as well as connections using TLS 1.2 and earlier. Pull request provided by gastush. (markt)
• Update: Update the Windows build environment to use Visual Studio

1. (markt) 1.3.1

• Fix: Fix a crash on Windows when SSLContext.setCACertificate() is invoked with a null value for caCertificateFile and a non-null value for caCertificatePath until properly addressed with https://github.com/openssl/openssl/issues/24416. (michaelo)
• Add: Use ERR_error_string_n with a definite buffer length as a named constant. (schultz)
• Add: Ensure local reference capacity is available when creating new arrays and Strings. (schultz)
• Update: Update the recommended minimum version of OpenSSL to 3.0.14. 1.3.0
• Update: Drop useless compile.optimize option. (michaelo)
• Update: Align Java source compile configuration with Tomcat. (michaelo)
• Fix: Fix version set in DLL header on Windows. (michaelo)
• Update: Remove an unreachable if condition around CRLs in sslcontext.c. (michaelo)
• Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(), the default verify paths are no longer set. Only the explicitly configured trust store, if any, will be used. (michaelo)
• Update: Update the minimum supported version of LibreSSL to 3.5.2.
• Design: Remove NPN support as NPN was never standardised and browser support was removed in 2019. (markt)
• Update: Update the recommended minimum version of OpenSSL to 3.0.13.

• Fix build after removal of the default %%{java_home} define
• Update to 1.2.39:

• Fix: 67061: If the insecure optionalNoCA certificate verification mode is used, disable OCSP if enabled else client certificates from unknown certificate authorities will be rejected.
• Update: Update the recommended minimum version of OpenSSL to 3.0.11.
• Change the hardcoded libopenssl-1_1-devel to libopenssl-devel for distributions that have the right version

• Version update to version 1.2.38:

• Align default pass phrase prompt with HTTPd.
• #66669: Fix memory leak in SNI processing.
• Update the recommended minimum version of OpenSSL to 1.1.1v.
• Update the recommended minimum version of APR to 1.7.4.
• Document the TLS rengotiation behaviour.
• Add HOWTO-RELEASE.txt that describes the release process.
• Refactor library initialization so it is compatible with Tomcat 10.1.x onwards where a number of Java classes have been removed.
• Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to allow clients to determine if the FIPS provider is being used when Tomcat Native is compiled against OpenSSL 3.x.
• #66035: Fix crash when attempting to read TLS session ID after a handshake failure.
• Enable download_deps.sh to be called from any directory.
• Fix release script so it works with the current git layout.
• #65441: Correct previous fix that enabled building to continue with OpenSSL 3.x.
• #65659: Remove remaining reference to pkg-config which is no longer included in the Tomcat Native distribution.
• #65181: Additional changes required to provided support for using OpenSSL Engines that use proprietary key formats.
• #65329: Correct handling of WINVER in make file to use correct constant for Windows 7. Add constants for Windows 8, Windows 8.1 and Windows 10. Rename WINNT to WIN2k as it is used for Windows 2000 upwards, not Windows NT upwards.
• Add a patch for APR that fixes an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual stack systems even though configured to listen on both IPv6 and IPv4 addresses.
• Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file was provided and no OpenSSL Engine was configured.
• #65181: Improve support for using OpenSSL Engines that use proprietary key formats.
• Enable building to continue against OpenSSL 3.x and 1.1.1.
• Incomplete name mangling fix for C++ compilers in tcn_api.h.
• Improve OS-specific header include for native thread id.
• Disable keylog callback support for LibreSSL.
• Add support for SSLContext.addChainCertificateRaw() with LibreSSL 2.9.1 and up.
• Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
• Remove default option passed for rpath to linker on HP-UX.
• Add an option to allow the OCSP responder check to be bypassed. Note that if OCSP is enabled, a missing responder is now treated as an error.
• #64429: Fix compilation with LibreSSL.
• #63671: libtcnative does not compile with OpenSSL < 1.1.0 and APR w/o threading support.
• Correct configure message for OpenSSL libdir.
• #64260: Clean up install target.
• #64315: configure output for OpenSSL wrong/incomplete sometimes.
• Drop obsolete build time workarounds for HP-UX.
• Add support for FreeBSD's pthread_getthreadid_np() in our ssl_thread_id(void).
• #64316: Introduce tcn_get_thread_id(void) to reduce code duplication.
• Fix linking against OpenSSL in non-standard locations on FreeBSD.

• Add GPG keyring.
• Version update to version 1.2.23:

• See changelog.html for in-depth upstream changes

• Version update to version 1.2.21:

• Fix incompatibility with Tomcat (bsc#1130843)

• Version update to version 1.2.16:

• Fixes build breakage with newer version of openssl

• Version update to version 1.2.4:

• This connector to properly work requires openssl 1.0.2 or newer so do not backport to other codestreams.

• Remove keyring file as there is new keyring and I didn't find it on the web
• Update to version 1.1.32

• Fix: 53952: Add support for TLSv1.2 and TLSv1.1.
• Fix: 56844: Use OpenSSL 1.0.1j with Windows binaries.
• Update: Use APR 1.5.1 with Windows binaries

• version 1.1.30

• Fixed double-free in ssl_ocsp_request. Patch provided by Aristotelis.
• Other minor bugfixes.

Changes for tomcat:

Update to Tomcat 9.0.123

• Catalina

• Fix: When starting a web application, don't try and use the web application class loader until after the web application class loader has started. (markt)
• Fix: various concurrency issues around adding and removing Realms from a CombinedRealm, in particular doing so while the CombinedRealm is in use. Note that once a Realm instance has been removed from a CombinedRealm instance at run-time, the removed Realm instance may not be reused apart from re-adding it to the same CombinedRealm. (markt)
• Update: When StoreConfig re-writes an existing server.xml or context configuration file, preserve the layout of the existing file (comments, blank lines and attribute order) on a best effort basis. (remm)
• Fix: Track in StandardContext whether the context was deployed from a Context element in server.xml. Use it to have StoreConfig save to a new config file. (remm)
• Fix: Improve error handling on start-up. (markt)
• Fix: byte range responses generated by DefaultServlet so a short resource stream read does not truncate the response. Treat a premature end of stream as an I/O error. Based on pull request #1067 by aoto-tech. (markt)
• Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw an Error when FIPS is requested but not available. (markt)
• Fix: Ensure that, as per the documentation, a simple bind is always used when the JNDI realm binds using the user provided name and password to authenticate the user. (markt)
• Update: Optimize Accept-Language header processing and use of resource budles for localization. (remm)

• Coyote

• Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based implementations of SSLEngine when the first flight of handshake messages sent by the server is too large to fit in the buffer used by the BIO pair. Patch submitted by Lukas Hellebrandt. (remm)
• Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on uploads. Submitted by Tim Burke. (remm)
• Fix: Avoid very rare race between async write notification and completion. Skip the write notification in these cases since it would be useless. (remm)
• Fix: a timing issue that could cause large non-blocking writes to stall for AJP connections. (markt)
• Fix: Ensure that the non-blocking write buffer is empty before sending an AJP end response message. (markt)
• Fix: CharChunk.indexOf(char) so that it searches from the start of the chunk rather than from twice the chunk's start offset when the chunk does not begin at the start of its buffer. (breken-ai)
• Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when part of the HTTP request body is received but not read. Based on a patch provided by Guillaume Darmont. (markt)
• Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it is certain the JAR is not shared. (remm)
• Fix: possible corruption of HTTP/1.1 chunked response bodies if a previous write to a chunked body fails. (markt)
• Fix: Align cipher order with the results produced by OpenSSL if the cipher specification adds, removes and then re-adds ciphers. (markt)
• Add: new attributes (unixDomainSocketParentPermissions and unixDomainSocketParentOwner) to the APR/Native connector to provide additional control over the security of Unix Domain Sockets. Additional checks (enabled by default) have also been added for the directory where the Unix Domain Socket will be created.(markt)
• Fix: Correct a narrow race condition when processing HTTP/2 headers.
• Fix: possible TLS connections failures caused by one of the flags Tomcat uses to track TLS handshake progress not being correctly reset. (markt)
• Fix: Allow for absolute host names in SNI checks. (markt)
• Fix: Correct a gap in asynchronous error handling that could lead to unexpected IllegalStateExceptions for some error conditions. (markt)
• Add: Harden HTTP/2 against applications that do not correctly handle asynchronous errors. (markt)

• Jasper

• Fix: Route JspC servlet context logging through Ant when used as an Ant task. (sainadh777)
• Fix: the tag plugin for the JSTL <c:redirtect> tag so that page processing ends with the redirect. (markt)

• Web applications

• Add: Documentation: Explicitly state that virtual host matching via the HTTP host header and TLS configuration matching via SNI are completely separate processes. (markt)
• Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the WebSocket drawboard. (sainadh777)

• Other

• Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)
• Update: to NSIS 3.13. (markt)
• Update: to Byte Buddy 1.18.14. (markt)
• Update: to Bouncy Castle 1.8.6. (markt)
• Add: Improvements to French translations. (remm)
• Add: Improvements to Japanese translations provided by tak7iji. (markt)

• Cluster

• Fix: Replicate SSO session key set changes made by removeSession() and sessionChangedId() in ClusterSingleSignOn so that SSO entries are correctly deregistered and removed from all nodes when the last associated session expires, even when the sessions expire on different cluster nodes. (remm)
• Fix: Move context attributes that were set while the web application was still starting into the replicated attribute map when it is installed in ReplicatedContext, so that they are replicated to the other nodes like attributes set later on rather than remaining local to the node that started the application. (remm)
• Fix: a possible deadlock in DeltaSession.expire(): the final session delta is now captured and sent to the cluster before the session monitor is acquired, because obtaining the delta takes the delta lock and code that runs while the delta lock is held, such as session attribute listener notifications, may in turn wait for the session monitor. (remm)
• Fix: Fire the documented send_message_failure lifecycle event with the message, destination and exception when a SimpleTcpCluster message send fails and notifyLifecycleListenerOnFailure is enabled. The event was previously declared but never fired. (remm)
• Fix: a possible deadlock in DeltaSession: session attribute listeners are no longer called while the delta lock is held when attributes are set or removed. The delta lock is only held while the change is recorded. (markt)
• Fix: a possible deadlock in DeltaSession: received session deltas are now read into a separate DeltaRequest from the one the session uses to record local changes. This avoids having to hold the delta lock while processing received changes. (markt)
• Fix: an issue replicating SessionListener additions and removals that meant some modification were not replicated leading to inconsistent listener configurations across the cluster. (markt)

• Tribes

• Docs: Document Tribes channel, membership, transport and replication status available through JMX. Based on pull request #1071 by sainadh777.
• Fix: Improve the handling of AsyncContext.dispatch() when the Context attribute dispatchersUseEncodedPaths is set to false since the application has no control over the path used for the AsyncContext.dispatch(). Prior to this fix, paths containing literal '?' characters were truncated. (markt)
• Fix: Ensure that capture groups from a RewriteCond always reflect the result of the current request. (markt)
• Fix: When a PersistentManager needs to reduce the number of active sessions, swap out the least recently used eligible sessions first. Pull request #1045 provided by sainadh777. (markt)
• Fix: Align web.xml logging output with the new Context attribute urlPatternsProvidedInDecodedForm. (markt)
• Fix: Improve robustness of DIGEST authentication to system clock jumps.
• Add: Support multiple protocol header values (treat as a single merged header value) in the RemoteIpFilter and RemoteIpValve. (markt)
• Fix: potential concurrency issues when loading/saving sessions from/to a session store. Custom Store implementations that do not extend StoreBase must implement the new getSessionStoreLock() method of the Store interface to ensure concurrency protection. The default method implementation provided only provides the pre-fix functionality. (markt)
• Fix: Ensure that PersistentManager implementations that extend PersistentManagerBase do not swap out sessions that are associated with a request that is currently being processed. As a result, it is now a requirement that the system property org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either minIdleSwap or maxIdleSwap are configured. (markt)
• Fix: xreflection generated code stack overflow issue. (remm)
• Fix: Align xreflection better with IntrospectionUtils. (remm)
• Fix: In HTTP/2 after half closed (remote), any unexpected frame should be a stream error. (remm)
• Fix: incorrect initial window size calculation when upgrading to HTTP/2. (remm)
• Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)
• Fix: Only try and load the native library from the CATALINA_HOME system property when the property is set. (markt)
• Fix: max connections enforcement after an enpoint resume. (remm)
• Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)
• Add: length validation for ALPN protocol names. (markt)
• Fix: Make FFM certificate verification more robust. (markt)
• Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing failure as if no usable OCSP URLs were present. (markt)
• Fix: Make the processing of OCSP responses more robust. (markt)
• Fix: Stricter OCSP handling when soft-fail is disabled. (markt)
• Fix: Cleaner handling of AJP response headers which overflow the maximum message size. (remm)
• Fix: Small per performance optimisation. Don't waste cycles swallowing an AJP response body when the connection is going to be closed. (markt)
• Fix: OpenSSL support for CRLs when using OpenSSL trust with the server key held in a Java key store. (markt)
• Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding header. (markt)
• Fix: Ensure per request HTTP/2 bad request marker is cleared when the request is recycled. (markt)
• Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)
• Fix: Revert earlier refactoring of HTTP/2 header field validation that moved it earlier since the refactoring made correct handling of invalid headers more difficult. (markt)
• Fix: EL evaluation of some lambda expressions. (remm)

• WebSocket

• Fix: an exception when an automatic Pong response races with the closing of the WebSocket session. (moritzfl)
• Fix: Harden the WebSocket client and use a SecureRandom when generating the Sec-WebSocket-Key header. (markt)
• Fix: Improve robustness of client handshakes. (remm)
• Fix: Ensure that WebSocket write timeouts apply to the complete message and are not lost if two writes have the same timeout. (markt)
• Fix: Reduce CPU usage while sending WebSocket close message. (markt)
• Fix: overly broad check that prevented request URIs containing literal { and } characters from being mapped to WebSocket end points. (markt)
• Fix: handling of WebSocket messages with compressed payloads using per- message-deflate that have one or more non-final blocks where the BFINAL bit is set. (markt)
• Fix: handling of per-message-deflate context takeover when receiving compressed WebSocket messages. (markt)
• Fix: Manager: Fix a potential concurrency issue when ordering sessions prior to displaying a list of session. (markt)
• Docs: Wrap the RewriteRule regular expression syntax reference on narrow displays. Pull request #1044 by sainadh777. (markt)
• Update: Easymock to 5.7.0. (markt)
• Update: bnd to 7.4.0. (markt)
• Update: Tomcat Native to 1.3.9. (markt)
• Add: Improvements to Japanese translations provided by tak7iji and Ktamura.biz.80. (markt)
• Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a positive integer. Zero or negative values previously caused an infinite loop or a NegativeArraySizeException during session state transfer. Pull request #1042 provided by lihongyi87. (markt)
• Fix: Improve robustness of cloud membership providers if an error occurs fetching members. (remm)

• jdbc-pool

• Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to getConnection(String,String) rather than getConnection(). (markt)
• Add: Log a warning if an attempt is made to obtain a connection with credentials when alternateUsernameAllowed is set to false. (markt)
• Fix: Ensure StatementCache interceptor resets properties of cached statements between uses. (mark)