Bug#1110075: tomcat9: Regression in 9.0.107-0+deb11u1 breaks startup and applications

[Markus Koschany]

Hello,

On Tue, 29 Jul 2025 11:18:20 +0200 Roland Tapken <dev+debian at cybso.de> wrote:
> Package: tomcat9
> Version: 9.0.43-2~deb11u10
> Severity: important
> X-Debbugs-Cc: dev+debian at cybso.de
> 
> After upgrading from (9.0.43-2~deb11u12 to 9.0.107-0+deb11u1, the startup
> failed with:
> 
> > Unrecognized VM option 'CMSPermGenSweepingEnabled'
> 
> After removing that option the unchanged application fails with:
> 
> >   org.springframework.beans.factory.BeanCreationException: Error creating
> >   bean with name 'reportDefinitionRegistry' defined in ServletContext
> >   resource [/WEB-INF/applicationContext.xml]: Invocation of init method
> >   failed; nested exception is javax.xml.bind.JAXBException: Implementation
> >   of JAXB-API has not been found on module path or classpath.
> >  - with linked exception:
> >       [java.lang.ClassNotFoundException:
> >        com.sun.xml.internal.bind.v2.ContextFactory
> > ...
> > Caused by: java.lang.ClassNotFoundException: 
> >    com.sun.xml.internal.bind.v2.ContextFactory
> > at org.apache.catalina.loader.WebappClassLoaderBase.loadClass
> >     (WebappClassLoaderBase.java:1354)
> > at org.apache.catalina.loader.WebappClassLoaderBase.loadClass
> >     (WebappClassLoaderBase.java:1163)
> > at javax.xml.bind.ServiceLoaderUtil.nullSafeLoadClass
> >     (ServiceLoaderUtil.java:122)
> > at javax.xml.bind.ServiceLoaderUtil.safeLoadClass
> > at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:276)
> >     
> >         ... 59 more
> 
> Our /etc/default/tomcat9 is:
> 
> > JAVA_HOME=/usr/lib/jvm/temurin-8-jre-amd64
> > JAVA_OPTS="-Djava.awt.headless=true -XX:+UseConcMarkSweepGC -Xms1024m"
> > JAVA_OPTS="${JAVA_OPTS} -Xmx10240m -XX:MaxPermSize=1024M "
> > JAVA_OPTS="${JAVA_OPTS} -XX:+CMSClassUnloadingEnabled"
> > JAVA_OPTS="${JAVA_OPTS} -XX:+CMSPermGenSweepingEnabled"
> > JAVA_OPTS="${JAVA_OPTS} -Dlog4j2.formatMsgNoLookups=true"

[...]

Regarding the "CMSPermGenSweepingEnabled" option, we don't support Temurin
hence I can't look closer into it. Is this one even necessary with newer Tomcat
versions? Can you reproduce the problem with OpenJDK from the Debian archives? 

The JAXB-API class not found exception might indicate that 
libjaxb-api-java is missing on the classpath. I presume that should be added on
the application level. I'm currently not aware of a missing tomcat9 dependency.

Regards,

Markus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: This is a digitally signed message part
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20250811/0591570e/attachment.sig>