Hi,

The following vulnerability was published for tocmat.

CVE-2025-55668[0]:
| Session Fixation vulnerability in Apache Tomcat via rewrite valve.
| This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7,
| from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
| Older, EOL versions may also be affected.  Users are recommended to
| upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-55668
https://www.cve.org/CVERecord?id=CVE-2025-55668
[2] https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore