Changelog

This release resolves CVE-2021-28169 and CVE-2021-34428
#6099 Cipher preference may break SNI if certificates have different key types
#6186 Add Null Protection on Log / Logger
#6205 OpenIdAuthenticator may use incorrect redirect
#6208 HTTP/2 max local stream count exceeded
#6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
#6254 Total timeout not enforced for queued requests
#6263 Review URI encoding in ConcatServlet & WelcomeFilter
#6277 Better handle exceptions thrown from session destroy listener
#6280 Copy ServletHolder class/instance properly during startWebapp

Provide feedback