Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/tomcat

              main @ 41e5f87
            

Fixes

CVEs

CRITICAL

Peak severity

36.4%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

DigestAuthenticator: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: URL double-decoding discrepancies during configuration pattern matching can lead to comprehensive security constraint bypasses. Developers should verify that URL patterns are decoded consistently exactly once prior to evaluation.

Auth Bypass: Incomplete tracking of client handshake counts during TLSv1.3 Post-Handshake Authentication (PHA) allows clients to bypass mandatory certificate validation, rendering trust manager checks ineffective.

Memory Management: Premature certificate cleanup when running with specific OpenSSL 1.1.x native libraries leads to double-free or use-after-free conditions during certificate validation workflows.