Connect2id server 19.16.1
This maintenance release of Connect2id server updates several upstream dependencies and hardens the processing of encrypted JWTs with compressed payloads by limiting memory consumption during decompression.
The JDBC driver for deployments with MySQL and MariaDB is updated to address four published vulnerabilities: three rated high severity and one rated medium.
The remaining dependency updates address issues that do not directly affect the Connect2id server. Our policy is to avoid using Jackson to process client input. A few transitive dependencies however use it to parse configuration data.
The Apache Tomcat packages and published Docker images include Tomcat 10.1.60, which also fixes several reported vulnerabilities.
We recommend updating to 19.16.1.
Connect2id server 20.0 is scheduled for release next week, targeting Java 21 and 25 and bringing significant improvements under the hood.
Download 19.16.1
For the signature validation: Public GPG key
Standard Connect2id server edition
Apache Tomcat package with Connect2id server 19.16.1: Connect2id-server.zip
GPG signature: Connect2id-server.zip.asc
SHA-256: 28d29be227c9970846768acfd5b4f1b1eb5cc58c64a5ec22b9e25269e06c67bf
Connect2id server 19.16.1 WAR package: c2id.war
GPG signature: c2id.war.asc
SHA-256: 1c292f18302b281883b68a860d6cc9b1e2fe55e618e98a04175ee00be85042c8
Multi-tenant edition
Apache Tomcat package with Connect2id server 19.16.1: Connect2id-server-mt.zip
GPG signature: Connect2id-server-mt.zip.asc
SHA-256: 4c62b26f253bfa3b40e9ae4645a423b5f8499e2360f97a6e01d8f70d62dd88d2
Connect2id server 19.16.1 WAR package: c2id-mt.war
GPG signature: c2id-mt.war.asc
SHA-256: 48d4a2c66acb1e665e31e68850aae4e7b8ab39488776e63a6db9b907ad7fb6d2
Questions?
For technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.
Release notes
19.16.1 (2026-10-02)
Dependency changes
-
Updates to com.nimbusds:nimbus-jose-jwt:10.10
-
Updates to com.google.crypto.tink:tink:1.23.0
-
Updates to org.bouncycastle:bcprov-jdk18on:1.86
-
Updates to org.bouncycastle:bcpkix-jdk18on:1.86
-
Updates to net.thisptr:jackson-jq:1.6.5
-
Updates to com.fasterxml.jackson.core:jackson-databind:2.22.3
-
Updates to org.mariadb.jdbc:mariadb-java-client:2.7.14
-
Updates to com.microsoft.sqlserver:mssql-jdbc:13.6.0.jre11