[devin-ai-integration]

Summary

Fixes code-scan finding sfind-34c3ecec / SNYK-JAVA-ORGAPACHETOMCATEMBED-16643276 (CVE-2026-43514, CWE-208): tomcat-embed-core@8.5.15, which comes in through Boot 1.5.4's spring-boot-starter-web, compares the AJP secret in non-constant time. The first fixed release is 9.0.118. No 8.5.x release has the fix (8.5 is EOL).

 <properties>
   <java.version>1.8</java.version>
+  <tomcat.version>9.0.118</tomcat.version>
 </properties>

• The Boot 1.5 BOM uses ${tomcat.version} for tomcat-embed-core, -el, -websocket and tomcat-jdbc, so this one property moves all of them.
• Major bump (Tomcat 8.5 → 9), flagged as the remediation guidance asks. Boot 1.5 registers Tomcat's default servlet through Context.addServletMapping(String,String), and Tomcat 9 removed that method. Without a workaround the app fails at startup with NoSuchMethodError. The new config/TomcatConfig (EmbeddedServletContainerCustomizer) calls setRegisterDefaultServlet(false). Static files under /static are still served, because Spring MVC's ResourceHttpRequestHandler handles them, not the default servlet.
• Spring Boot, Java 8 and application code are unchanged. The other route is a Boot 2.7.x upgrade, which is a much larger change.
• Exposure is low: Boot does not open an AJP connector unless you configure one, and this app doesn't.

Verification (offline; this session's network allows only the git proxy)

• Resolved version: I copied the pom with the cached Boot 1.5.8 parent (1.5.4 isn't cached) and ran mvn -o maven-dependency-plugin:3.6.1:tree -Dincludes=org.apache.tomcat.embed. It shows tomcat-embed-core/-el/-websocket:9.0.118.
• Runtime: a Boot 1.5.8 / Spring MVC 4.3.12 smoke app on the newest cached Tomcat 9 (9.0.83), JDK 11, built with javac --release 8:
  • without TomcatConfig: Unable to start embedded container ... NoSuchMethodError: 'void org.apache.catalina.Context.addServletMapping(java.lang.String, java.lang.String)'
  • with this PR's TomcatConfig: Tomcat started. /ping returns 200 (9.0.83.0), the app's /css/main.css returns 200, and an unknown path returns 404.
• Not run: mvn test / a full UserFront boot against MySQL. The Boot 1.5.4 parent, the 9.0.118 jars and several 1.5.x starters aren't in the local Maven cache, and Maven Central can't be reached.
• Snyk before/after counts: not available. snyk test fails with SNYK-CLI-0000 because api.snyk.io is blocked. Please let the Snyk PR check confirm that the finding clears.

Related PRs

Under the one-PR-per-ticket rule this is a new PR. #208 has the identical change (9.0.118 plus TomcatConfig), and #33, #229 and #230 clear this CVE through a Boot 2.7 upgrade. Only one of these should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/286bc615aef147eeb314635436070a99
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/286bc615aef147eeb314635436070a99?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)