- CVE-2026-65182: ensure the security constraint with the longest matching path is selected (upstream tomcat 9.0.121) - CVE-2026-65183: improve the security of Unix domain sockets in the NIO and APR connectors (upstream tomcat 9.0.121 and 9.0.123) - CVE-2026-65905: fix incorrect rejection at the upper boundary of the DIGEST nonceCount window (upstream tomcat 9.0.121) - CVE-2026-65927: correct the rule index reset for [N], chain rule and query string processing in the rewrite valve (upstream tomcat 9.0.121) - CVE-2026-66422: separate the Context role mapping from security-role-ref (upstream tomcat 9.0.121) - CVE-2026-68525: refresh the security constraints after FORM authentication when the restored request changes the HTTP method, so a constraint that limits POST but not GET is re-evaluated instead of being bypassed (upstream tomcat 9.0.121) - CVE-2026-68569: various improvements to the DataSourceRealm and JDBCRealm (upstream tomcat 9.0.121, plus 45a3c1ef from the 9.0.x branch for a DataSourceRealm without a role store); a JDBCRealm in the default strict allRolesMode now needs a role store - CVE-2026-68763: return the unused HTTP/2 connection window allocation and drop the stream from the backlog when a stream is replaced after a reset, and keep backLogSize consistent, preventing a flow control allocation leak (upstream tomcat 9.0.121) - CVE-2026-73180: track the WebSocket sessions of an authenticated HTTP session by a key held in a session attribute rather than the live session id, so they are still closed when the HTTP session ends after its id has changed (upstream tomcat 9.0.121)