Tomcat 10 users need to deploy the axis2 into the webapps-javaee folder as explained here: https://tomcat.apache.org/migration-10.html#Migrating_from_9.0.x_to_10.0.x.

As explained in AXIS2-4311, the same package name org.apache.axis2.transport was in both the kernel and transport modules. This broke both OSGI support and the Java 9 modules feature. The kernel version of this package was renamed to org.apache.axis2.kernel.

Users are strongly encouraged to update their axis2.xml since the package name changed for the classes org.apache.axis2.kernel.http.XFormURLEncodedFormatter, org.apache.axis2.kernel.http.MultipartFormDataFormatter, org.apache.axis2.kernel.http.ApplicationXMLFormatter, org.apache.axis2.kernel.http.SOAPMessageFormatter, and org.apache.axis2.kernel.http.SOAPMessageFormatter.

Any code references for the HTTPConstants class needs to be updated to org.apache.axis2.kernel.http.HTTPConstants.

All dependencies were updated to the latest version where it was easily possible to do so. Users are strongly encouraged to manage and update their pom.xml for updates themselves and not wait for the Axis2 team, since CVE's occur so often it is impractical to do a release for every update.

We will do our best and try to release as frequently as possible. However, do not wait for us on zero day exploits - just update your pom.xml.