Shibboleth Identity Provider Security Advisory [13 May 2026]

[Peter Schober]

Martin Hitschel via users <users at shibboleth.net> [2026-05-15 15:50 CEST]:
> FWIW, we've just done a 5.2.2 test upgrade [...] This customer's IdP
> is on Ubuntu24 with a > distribution's tomcat10 and OpenJDK21.

Off-topic, but how's that possible? IDP 5.2 requires Servlet API 6.1
but that only comes with Tomcat 11:
https://tomcat.apache.org/tomcat-11.0-doc/RELEASE-NOTES.txt

I looked into https://packages.ubuntu.com/noble/all/libtomcat10-java
(which is what contains the servlet-api.jar) but couldn't easily
identify the version from the files there. They are all timestamped
with 2023, though. So I'd claim that this is still v6.0.

-peter