{
 "slug": "tomcat",
 "name": "Apache Tomcat",
 "tagline": "Jakarta EE Servlet, JSP and WebSocket application server",
 "category": "api-app-server",
 "use_cases": [
  "java-web-apps",
  "servlet-container",
  "jakarta-ee"
 ],
 "aliases": [
  "apache tomcat"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://tomcat.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://www.apache.org/licenses/LICENSE-2.0"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "11.0.27",
   "last_build": "2026-10-23",
   "entity_id": "prod-xgyg5uzu5l2fm",
   "ami_alias": "/aws/service/marketplace/prod-xgyg5uzu5l2fm/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-4xtuynpsttfmu",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "11.0.26",
   "last_build": "2026-09-16",
   "offer_id": "tomcat",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:tomcat:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.tomcat?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/tomcat/",
  "json": "https://lynxroute.com/products/tomcat/product.json"
 },
 "release_notes": [
  {
   "version": "11.0.27",
   "title": "Apache Tomcat 11.0.27",
   "notes": "* Apache Tomcat updated 11.0.26 -> 11.0.27. Apache-2.0 unchanged\n* Security (Important): CVE-2026-103119 (AJP response mix-up), CVE-2026-101356 (HTTP/2 response mix-up) and CVE-2026-101296 (JNDIRealm bind failing open)\n* Security (Low): CVE-2026-93446, CVE-2026-88041, CVE-2026-74049, CVE-2026-74048\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "11.0.26",
   "title": "Apache Tomcat 11.0.26",
   "notes": "* Apache Tomcat 11.0.26 maintenance release, upgraded from 11.0.25. Apache-2.0 unchanged\n* Authentication: FORM login actions require HTTP POST, DIGEST authentication is more robust to system clock jumps, and Jakarta Authentication configuration is cached per web application\n* Connectors: stricter HTTP/2 stream and content-length handling, HTTP/1.0 requests carrying transfer-encoding are rejected, and ALPN matching and OCSP processing are stricter for OpenSSL FFM connectors\n* WebSocket and sessions: per-message-deflate fixes, SecureRandom Sec-WebSocket-Key generation, and PersistentManager swaps out least recently used idle sessions first\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-15",
    "azure": "2026-09-16"
   }
  },
  {
   "version": "11.0.25",
   "title": "Apache Tomcat 11.0.25 - upgraded from 11.0.24. Maintenance release: directory listings produced by the default servlet escape the context path and the current and parent directory names, with XML escaping for XML output; digest authentication no longer rejects a client nonce count at the upper boundary of the window; sessionAttributeValueClassNameFilter is extended to dynamic proxy interface classes; the rewrite N, C and qsd flags are evaluated correctly; a login-config conflict when merging web-fragment descriptors now fails the deployment; and adding a session attribute concurrently with expiry is handled deterministically. Adds the Context attribute urlPatternsProvidedInDecodedForm to ease migration to Tomcat 12. Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.",
   "notes": "",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-09-06"
   }
  },
  {
   "version": "11.0.22",
   "title": "Apache Tomcat 11.0.22",
   "notes": "* Apache Tomcat 11.0.22 on Ubuntu 24.04 LTS (OpenJDK 17, Jakarta EE 11)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* HTTP connector bound to 127.0.0.1:8080; nginx terminates TLS on port 443\n* Manager / Host-Manager never exposed on the public perimeter; admin password generated at first boot\n* Insecure bundled examples webapp removed; runs as non-root tomcat user (UMask 0027)\n* JVM heap auto-sized to the instance RAM at first boot\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-06-15"
   }
  }
 ],
 "release_history": [
  {
   "version": "11.0.27",
   "aws": "2026-10-23"
  },
  {
   "version": "11.0.26",
   "aws": "2026-09-15",
   "azure": "2026-09-16"
  },
  {
   "version": "11.0.25",
   "aws": "2026-08-23",
   "azure": "2026-09-06"
  },
  {
   "version": "11.0.24",
   "aws": "2026-07-10",
   "azure": "2026-07-27"
  },
  {
   "version": "11.0.22",
   "aws": "2026-06-15"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-xgyg5uzu5l2fm/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer tomcat --plan payg-gen2\naz vm create -g my-rg -n tomcat --size Standard_D2s_v3 \\\n  --image lynxroute:tomcat:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Tomcat is the world's most widely deployed Java application server and the reference implementation of the Jakarta EE Servlet, JSP, Expression Language, WebSocket and Authentication specifications, maintained by the Apache Software Foundation. Tomcat 11 targets Jakarta EE 11 (the jakarta.* namespace, not the legacy javax.*) and requires Java 17 or newer. It runs servlet/JSP web applications and WAR files with a small footprint, fast startup and a mature, battle-tested codebase. This image ships the official Apache binary distribution (verified against the upstream SHA-512 checksum) running on OpenJDK 17, as a non-root service. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* HTTP connector bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed\n* Manager and Host-Manager webapps are never reachable from the internet (nginx returns 403 at the perimeter, and Tomcat additionally restricts them to localhost connections)\n* Manager admin password generated uniquely at first boot, written to /root/tomcat-credentials.txt (mode 600)\n* The insecure bundled \"examples\" webapp (sample servlets with known demo vulnerabilities) is removed\n* Runs as a non-root tomcat system user with UMask 0027\n* JVM heap (-Xms/-Xmx) auto-sized to the instance RAM at first boot\n* UFW firewall pre-configured (only ports 22 and 443 open)\n* certbot pre-installed - one command swaps the self-signed cert for a CA-signed one\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}