tomcat
AGENTS.md8.3k starsChanged 19 days agoApache-2.0View on GitHub
This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output. Security model: SECURITY.md, which links to the canonical model document at <https://tomcat.apache.org/security-model.html>. Agents that scan this repository should consult the linked security model for the project's threat model, in-scope / out-of-scope declarations, and known non-findings before reporting issues.
Trending
More talk lately.about the whole repository
Who's talking about apache/tomcat
- Stack Overflow“Tomcat 7 setenv.sh is not found”Stack Overflow · Sep 21, 2013 · 31 votes
- Stack Overflow“How do I create a parent-last / child-first ClassLoader in Java, or How to override an old Xerces version …”Stack Overflow · Mar 26, 2011 · 14 votes
- Stack Overflow“Why WsSessionListener.sessionCreated() emit `AbstractMethodError` in embed tomcat 9?”Stack Overflow · Jan 21, 2019 · 11 votes
- Stack Overflow“Tomcat graceful shutdown”Stack Overflow · Oct 18, 2018 · 11 votes
- Stack Overflow“Servlet for serving static content”Stack Overflow · Sep 25, 2008 · 11 votes
The biggest 5 of 46 mentions linking to the repository that our crawl found. Each line is their own headline.
See all 46
Talked about on Stack Overflow and GitHub (46 times).
On Stack Overflow · 25
- Sep 21, 2013Tomcat 7 setenv.sh is not found31 votes
- Mar 26, 2011How do I create a parent-last / child-first ClassLoader in Java, or How to override an old Xerces version that was already loaded in the parent CL?14 votes
- Jan 21, 2019Why WsSessionListener.sessionCreated() emit `AbstractMethodError` in embed tomcat 9?11 votes · 3 answers
- Oct 18, 2018Tomcat graceful shutdown11 votes
- Sep 25, 2008Servlet for serving static content11 votes
20 more on Stack Overflow
- Sep 15, 2014FileUploadBase$SizeLimitExceededException Apache Tomcat7 votes
- Mar 8, 2019How to debug Tomcat source code in Intellij Idea?6 votes
- Jun 20, 2018Archiva context path is ignored on Tomcat5 votes
- Oct 19, 2023Configuring SSL programatically of a Spring Boot server with Tomcat is failing4 votes · 1 answer
- Dec 13, 2015Is it a bad practice to catch Throwable?4 votes
- Apr 19, 2014Why Tomcat's Non-Blocking Connector is using a blocking socket?4 votes
- Oct 2, 2024The ServletFileUpload class has disappeared from version tomcat-embed-core-10.1.0 and following3 votes
- Sep 6, 2018What is ServiceLoader and how is it used?3 votes
- May 15, 2018Tomcat WebSocket BufferOverflowException3 votes · 2 answers
- Feb 10, 2021How to enable samesite for jsessionid cookie2 votes
- Jan 30, 2020SEVERE - For security constraints with URL pattern [/*] the HTTP methods [POST GET] are uncovered2 votes
- Jan 21, 2020Tomcat logs user out during session failover event and restarts2 votes
- Nov 28, 2017Request header too large while sending image in REST response2 votes
- Jul 24, 2017Avoid waiting on Servlet streams2 votes
- Nov 16, 2011Appending TimeStamp in log file name of Java util logger2 votes
- Dec 31, 2024Unable to read multipart stream with Apache httpupload1 vote
- Aug 7, 2023Unique jsessionid with more than one tomcat1 vote
- Mar 28, 2022Tomcat 7 AccessLogValve maxDays not deleting access log files1 vote
- Nov 19, 2020Client's certificate authentication issue in Tomcat in 7.0.100+1 vote · 1 answer
- Feb 24, 2020Understanding "Request Header is too large"1 vote
On GitHub · 21
- Dec 10, 2018Call newInstance on Constructor of driverClass — brettwooldridge/HikariCP6 reactions · 1 comment
- Oct 23, 2026Tomcat's new 'maxLocaleCount' property cannot be easily configured — spring-projects/spring-boot3 reactions · 5 comments
- Mar 12, 2024Reactive stack on Tomcat does not handle chunked transfer encoding correctly — spring-projects/spring-framework3 reactions · 9 comments
- May 16, 2023OF-2600: Upgrade Jetty 9.4.43.v20210629 to 10.0.16 — igniterealtime/Openfire2 reactions · 5 comments
- Oct 15, 2021A multipart graphql request is sensitive to the default charset of the jvm — graphql-java-kickstart/graphql-java-servlet2 reactions
16 more on GitHub
- Oct 4, 2026deps: Tomcat 9.0.122, new runtime images, and declared Rust versions with a CI check — freeunitorg/freeunit1 reaction
- Jun 25, 2026Add support for HTTP QUERY method - RFC 10008 — jakartaee/servlet1 reaction · 5 comments
- Apr 28, 2026fix(deps): update dependency commons-fileupload:commons-fileupload to v1.6.0 [security] — GoogleCloudPlatform/getting-started-java1 reaction
- Apr 27, 2026fix(deps): update dependency commons-fileupload:commons-fileupload to v1.6.0 [security] - autoclosed — GoogleCloudPlatform/getting-started-java1 reaction
- Nov 17, 2025Upgrade org.apache.tomcat to 11.0.14 — operaton/operaton1 reaction
- Nov 4, 2025Provide configuration properties for controlling the size of Tomcat's buffers for binary and text WebSocket messages — spring-projects/spring-boot1 reaction · 9 comments
- Jun 30, 2022[FP]: CVE-2022-34305 reported for tomcat-embed-core and tomcat-embed-websocket — dependency-check/DependencyCheck1 reaction · 7 comments
- Jun 24, 2021Consider "wss" and "https" for secure flag in Forwarded header checks — spring-projects/spring-framework1 reaction · 5 comments
- Jan 21, 2018Removing CatchOfThrowableOrErrorCheck as there are good use cases for doing so — SonarSource/sonar-java1 reaction · 3 comments
- Nov 12, 2026bump paired Tomcat images and configuration — AaronFeledy/core40 reactions
- Nov 6, 2026chore(deps): Update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.25 [SECURITY] — Cognigy/mock-server-fork0 reactions
- Oct 28, 2026Add rate limiting (throttle) filter — VEuPathDB/EbrcWebsiteCommon0 reactions
- Oct 23, 2026[GHSA-f6r2-3pj4-jmqq] Incomplete cleanup vulnerability in Apache Tomcat allowed... — github/advisory-database0 reactions
- Aug 26, 2026tomcat-embed-jasper-11.0.24.jar: 16 vulnerabilities (highest severity is: 9.8) [main] — iriskamin-mend/spring-boot-maven0 reactions
- Aug 26, 2026tomcat-embed-core-11.0.24.jar: 16 vulnerabilities (highest severity is: 9.8) [main] — iriskamin-mend/spring-boot-maven0 reactions
- Aug 26, 2026tomcat-embed-websocket-11.0.24.jar: 21 vulnerabilities (highest severity is: 9.8) [main] — iriskamin-mend/spring-boot-maven0 reactions
The file
Files
Agent guidance
This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output.
Security
Security model: SECURITY.md, which links to the canonical model document at https://tomcat.apache.org/security-model.html.
Agents that scan this repository should consult the linked security model for the project's threat model, in-scope / out-of-scope declarations, and known non-findings before reporting issues.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.