- CVE-2025-49125: require the request path to end at the mount point or continue past it with a /, instead of testing the mount point as a bare string prefix, so a PreResources or PostResources set mounted below the web application root can no longer be reached via an unexpected path that is not covered by the same security constraints; also strip a trailing / from webAppMount in all cases, as upstream does, so a resource set mounted on a path ending in / keeps resolving its nested paths under the stricter check - CVE-2026-55276: include the * and ** special roles and empty authorization constraints when generating the effective web.xml, so the logged descriptor no longer understates the security constraints that are actually in force