Skip to content

fix: bump tomcat-embed-* to 10.1.55 #7253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnBgood merged 1 commit into from
May 19, 2026
Merged

fix: bump tomcat-embed-* to 10.1.55 #7253

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
fix: bump tomcat-embed-* to 10.1.55
  • Loading branch information
@johnBgood
johnBgood committed May 18, 2026
commit 3d55836300a69bc1fde051f8be4fc90c9fb23682
33 changes: 33 additions & 0 deletions parent/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,10 @@ limitations under the License.</license.inlineheader>
<version.hamcrest>3.0</version.hamcrest>

<version.spring-boot>3.5.14</version.spring-boot>
<!-- CVE override: Spring Boot 3.5.14 ships Tomcat 10.1.54 which has a known vulnerability.
Remove once Spring Boot upgrades to Tomcat >= 10.1.55 (likely in 3.5.15+).
Ref: https://cve-registry.infosec.camunda-it.rocks/team/3/finding/3575 -->
<version.tomcat>10.1.55</version.tomcat>
<version.spring-cloud-gcp-starter-logging>7.4.7</version.spring-cloud-gcp-starter-logging>
<version.logback>1.5.32</version.logback>

Expand Down Expand Up @@ -203,6 +207,23 @@ limitations under the License.</license.inlineheader>
<type>pom</type>
</dependency>

<!-- CVE override for Tomcat - remove when version.tomcat property is removed -->
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>${version.tomcat}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-el</artifactId>
<version>${version.tomcat}</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
<version>${version.tomcat}</version>
</dependency>

<!-- Override Spring Boot BOM postgresql pin -->
<dependency>
<groupId>org.postgresql</groupId>
Expand Down Expand Up @@ -822,6 +843,18 @@ limitations under the License.</license.inlineheader>
<requirePluginVersions>
<banSnapshots>false</banSnapshots>
</requirePluginVersions>
<!-- CVE override reminder: fail build when Spring Boot is bumped past 3.5.14
so we remember to check if the Tomcat override (version.tomcat) can be removed.
Ref: https://cve-registry.infosec.camunda-it.rocks/team/3/finding/3575 -->
<requireProperty>
<property>version.spring-boot</property>
<regex>3\.5\.14</regex>
<regexMessage>
Spring Boot version was bumped! Check if the Tomcat CVE override (version.tomcat in parent/pom.xml) can be removed.
If the new Spring Boot version ships Tomcat >= 10.1.55, remove version.tomcat property and the tomcat-embed-* dependencyManagement entries.
Ref: https://cve-registry.infosec.camunda-it.rocks/team/3/finding/3575
</regexMessage>
</requireProperty>
</rules>
</configuration>
<executions>
Expand Down
Loading