{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:46e392e2-750b-57bf-98f0-8e609312fdcc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8",
      "version": "10.1.18-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5388",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:135729a4-a34f-56c8-9f71-60f6c42594a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5388 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in Tomcat 10.1.18. The vulnerability allowed attackers to set HTTP_PROXY environment variable in CGI processes via the Proxy HTTP header. The fix (envHttpHeaders whitelist filter) was already present in the upstream Apache Tomcat release that TuxCare onboarded. The vulnerable pre-fix code (blacklist approach that only excluded AUTHORIZATION/PROXY_AUTHORIZATION) is absent. The fix uses a whitelist regex that excludes the Proxy header, preventing HTTP_PROXY injection. Additionally, CGI Servlet is disabled by default in conf/web.xml.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3c56460c-8891-56f6-b29d-b2933437a5bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects JmxRemoteLifecycleListener, a component that was removed from Apache Tomcat before version 10.1.18 was released. The class was fixed by Apache in November 2016, deprecated in December 2019, and completely removed in January 2020. Tomcat 10.1.18 (tagged January 2024) never contained the vulnerable code. The functionality was migrated to the JRE's built-in remote JMX capability. No alternative JMX remote configuration code exists in the target that exhibits the vulnerability pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3e078a24-299c-5422-8628-c1bd25fb5836",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12616 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects VirtualDirContext and FileDirContext in Apache Tomcat 7.0.0 to 7.0.80. The target repository is Tomcat 10.1.18, where these components were completely removed and replaced by the WebResourceRoot/WebResourceSet architecture. The vulnerable code path does not exist in Tomcat 10. Furthermore, the replacement architecture has canonical path validation built into AbstractFileResourceSet.file() from the start (lines 92-100), providing equivalent protection to the CVE-2017-12616 fix. WebResourceRoot.java explicitly documents: \"VirtualDirContext - Replaced by Pre- and Post-Resources\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12617",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ccf83e8a-5a98-5efe-8c0b-1b46082cfac3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12617 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is not present in Tomcat 10.1.18. The vulnerability allowed uploading JSP files via HTTP PUT requests with paths ending in '/' because the Java File API silently drops trailing slashes. The fix (commit b7e0435d17) was authored by Apache developer Mark Thomas and was already present in the upstream release before TuxCare onboarded this version. The target contains the defensive check at DirResourceSet.java:264-268 that rejects file writes when paths end with '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0c92a91a-f5b0-545c-b6be-057d52c4b238",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5648 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.18 is NOT AFFECTED by CVE-2017-5648. The vulnerability was fixed by upstream Apache Tomcat maintainer Mark Thomas in commit dfa40863421d7681fed893b4256666491887e38c (March 6, 2017), which shipped in the upstream release before TuxCare onboarded this version. All affected code locations now correctly use request.getRequest() to pass facade objects (rather than internal request objects) to application listeners, preventing untrusted applications from retaining references that could access data from other web applications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bbdd9cc5-8ab7-53a0-901a-971666183a38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The vulnerability was fixed in upstream Apache Tomcat by commit 15fcd166ea (March 11, 2019) which added HTML entity encoding to variable values. This fix was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded (first TuxCare commit: 455b1de, dated after the ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-9484",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6f5e3813-19a6-5680-80cc-fe03d4cdcb64",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-9484 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. CVE-2020-9484 is NOT present in Apache Tomcat 10.1.18. The vulnerability affected versions 10.0.0-M1 to 10.0.0-M4, but the fix was already included in the upstream release 10.0.0-M5 and carried forward to 10.1.18. The target contains the complete path traversal validation fix in FileStore.java (lines 346-350) that prevents session IDs with path traversal sequences from deserializing files outside the intended storage directory. This fix was authored by Mark Thomas (Apache committer) and was already present in the upstream release when TuxCare onboarded version 10.1.18.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:94058e5c-76a7-513d-b8ad-c73533304cbb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. The target repository (Tomcat 10.1.18) is not affected by CVE-2022-45143. The vulnerability was fixed by upstream Apache in commit 1f50bff8da (November 9, 2022) before TuxCare onboarded this version. JsonErrorReportValve.java properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing JSON injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a845ca64-cd6a-54fc-bf27-feb6007aff1e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. CVE-2023-24998 (Apache Commons FileUpload DoS via unlimited multipart parts) is NOT present in Tomcat 10.1.18. The fix was already included in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded. The fileCountMax defense mechanism exists in FileUploadBase.java with proper integration in Request.java, and is enabled by default with safe limits (maxParameterCount=1000, maxPartCount=10). The vulnerable pattern (unbounded multipart processing) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28708",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f2efa795-a878-56e6-85c4-4faad810a2b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target Tomcat 10.1.18 is NOT AFFECTED by CVE-2023-28708. The complete fix for this vulnerability was already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The fix (authored by lihan@apache.org, introduced in Tomcat 10.1.10 on 2023-02-10) ensures that when RemoteIpFilter processes X-Forwarded-Proto=https headers, session cookies correctly receive the Secure att...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3d355985-558e-572c-be35-9c62eda66235",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.18. The upstream fix from commit bb4624a9f3e (by Mark Thomas, 2023-08-22) was already included in the Apache Tomcat 10.1.13+ release series. When TuxCare onboarded version 10.1.18, the fix was already present in the upstream code. The defense code at FormAuthenticator.java:765-7...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:063dfc9b-7ba6-5161-bf4f-3462d3f345dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:61e21f71-1174-554e-b6f7-a86b5ee43f37",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina. The target Tomcat 10.1.18 repository is not affected by CVE-2023-46589. The vulnerability (improper validation of HTTP trailer headers leading to request smuggling) was fixed in upstream Apache Tomcat commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas. This fix was already included in the upstream Tomcat 10.1.18 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-50379",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:036173e8-1bcc-50ac-9176-b1f7c76253e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-50379 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2024-52316",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6b90bfc7-99a4-5b25-b6f9-11819b1eaeea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2024-56337",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:74a47f82-d072-5506-ac5e-df205e802c97",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-56337 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-24813",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:41042343-6980-5f18-95b1-555858b813ff",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24813 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-31651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9c9196f0-b0ac-5945-9b2e-1a2fc03f78a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31651 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-46701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:60a33713-f4d5-5c51-b264-b9bc5920124f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-46701 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-48988",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8ae4c33f-72e5-5bfa-b077-1938fb782f37",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48988 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5ad0b163-a0be-591f-897a-ec53a4c308fe",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-49125",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:698d0fd9-020c-5ab2-8597-1d031eb6d7bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49125 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-52520",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0b598ff5-b289-5665-9995-76980bc319ac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55668",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ed255c67-18ff-512a-a3c1-77fdf87039e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55668 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:b147f13b-e1dc-56e0-a38e-33270decd6ee",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:48ffb013-216a-5bfb-89cf-7caa21e4663c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:cf8e48eb-5120-57a2-bdef-ac4aed074c70",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8b4639b4-3bdf-554c-8b06-6f7a5afd9534",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c37d37c1-13a5-59c0-b797-18554bbdd52f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0ea30f2c-62f7-5710-bda9-ebd2afb04128",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:2b6710fe-3883-58fc-8393-bb0f07406b0d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:72b96b02-f8e5-5140-a4ec-98d798c71d7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.18-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a9690925-0b5a-5a21-be6e-534d5f656a90",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.18-tuxcare.10."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9581d0d5-ed15-562c-baf1-76d5fa2e11b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8446b1a5-3ef2-5656-9269-c7cdf92f1d39",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:194794be-cc42-5b99-bac7-291940a882d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:45351a7f-b127-5abf-b461-67e08dcd8727",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:55356fba-9ff7-54a2-ab25-e38b22efd6f7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3301196d-23ff-5bbb-8da7-8860cc896428",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ad0532fd-1f20-59d1-a3cb-1b7a19204383",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65905 affects version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.18-tuxcare.10."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:2a854028-150f-5add-9739-96c34d2c7390",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.18-tuxcare.8 of org.apache.tomcat:tomcat-catalina."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.18-tuxcare.8"
    }
  ]
}