# Apache Tomcat 8.5.40 Released & CVE-2019-0232

**URL:** <https://community.sonatype.com/t/apache-tomcat-8-5-40-released-cve-2019-0232/1610>\
**Category:** Sonatype Lifecycle & Firewall\
**Created:** [April 16, 2019, 12:03am UTC](https://community.sonatype.com/t/apache-tomcat-8-5-40-released-cve-2019-0232/1610 "2019-04-16T00:03:42Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![pechandler](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/pechandler/32/606_2.png) [@pechandler](https://community.sonatype.com/u/pechandler)\
**Post date:** [April 16, 2019, 12:03am UTC](https://community.sonatype.com/t/apache-tomcat-8-5-40-released-cve-2019-0232/1610/1 "2019-04-16T00:03:43Z")

</div>

**My Nexus IQ Server says:**  
Apache Tomcat 8.5.40 (Group:org.apache.tomcat.embed Artifact:tomcat-embed-core Version: 8.5.40) has CVE-2019-0232

**Apache Tomcat says**

### Tomcat 8.5.40 Released

The Apache Tomcat Project is proud to announce the release of version 8.5.40 of Apache Tomcat. Apache Tomcat 8.5.x replaces 8.0.x and includes new features pulled forward from Tomcat 9.0.x. The minimum Java version and implemented specification versions remain unchanged. The notable changes compared to 8.5.39 include:

- Fix for CVE-2019-0232, an RCE vulnerability on Windows
- Add support for Java 11 to the JSP compiler. Java 12 and 13 are also now supported if used with a ECJ version with support for those Java versions
- Various NIO2 stability improvements

Full details of these changes, and all the other changes, are available in the [Tomcat 8.5 changelog](http://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.40_(markt)).

---

_[View the full topic](https://community.sonatype.com/t/apache-tomcat-8-5-40-released-cve-2019-0232/1610)._