Shibboleth Identity Provider Security Advisory [13 May 2026]

[Scott Cantor]

> On May 15, 2026, at 11:32 AM, Peter Schober via users <users at shibboleth.net> wrote:
> 
> Martin Hitschel via users <users at shibboleth.net> [2026-05-15 15:50 CEST]:
>> FWIW, we've just done a 5.2.2 test upgrade [...] This customer's IdP
>> is on Ubuntu24 with a > distribution's tomcat10 and OpenJDK21.
> 
> Off-topic, but how's that possible? IDP 5.2 requires Servlet API 6.1
> but that only comes with Tomcat 11:
> https://tomcat.apache.org/tomcat-11.0-doc/RELEASE-NOTES.txt
> 
> I looked into https://packages.ubuntu.com/noble/all/libtomcat10-java
> (which is what contains the servlet-api.jar) but couldn't easily
> identify the version from the files there. They are all timestamped
> with 2023, though. So I'd claim that this is still v6.0.

There is substantial evidence it runs fine on 6.0 as the API changed in 6.0, not 6.1. We simply aren't going to test or support everything by manually testing every combination in the hope that it works, we just go by the official documentation.

Spring 7 is what claims to require 6.1 and that's all we're going by.

-- Scott