{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d76fd8af-cab8-50f8-8917-d2a31cbea219",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1",
      "version": "10.1.33-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5388",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:59b7e3f5-24d9-5b58-af57-e2818921d6ee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5388 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.33 is not affected by CVE-2016-5388 (httpoxy vulnerability). The upstream fix from commit fb3569fbb9 (authored by Mark Thomas on 2016-08-19) is present and was already included in the 10.1.33 release that TuxCare onboarded. The fix replaces the vulnerable blacklist approach (which only blocked AUTHORIZATION and PROXY_AUTHORIZATION headers) with a secure whitelist regex pattern that prevents the Proxy header from being passed to CGI scripts as the HTTP_PROXY environment variable. The default whitelist pattern (ACCEPT[-0-9A-Z]*|CACHE-CONTROL|COOKIE|HOST|IF-[-0-9A-Z]*|REFERER|USER-AGENT) explicitly excludes PROXY, preventing attackers from injecting proxy configuration into CGI subprocess environments.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2851e97b-688a-59a1-b70d-3733f34d42a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Tomcat 10.1.33 is not affected by CVE-2016-8735. The vulnerable component JmxRemoteLifecycleListener was removed by upstream Apache on January 15, 2020 (commit 46fbf32e55), before Tomcat 10.0.0 was even released. The component has never existed in any Tomcat 10.x version, including 10.1.33. The INPUT defined in the Attack Vector Brief (JMX remote credentials sent to JmxRemoteLifecycleListener) cannot be received because the listener does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f79fbe1c-a7f8-5fbe-b655-22761ed00479",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12616 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects VirtualDirContext in Apache Tomcat 7.0.0 to 7.0.80. The target repository is Tomcat 10.1.33, where VirtualDirContext does not exist. The vulnerable component was removed during the architectural evolution from Tomcat 7 to Tomcat 8+, replaced by the WebResourceRoot/WebResourceSet system which includes canonical path validation by design. The new architecture was shipped in the upstream release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12617",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:36f59f28-7868-583f-8a21-28dfd79f5003",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12617 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is NOT present in Tomcat 10.1.33. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes (e.g., \"malicious.jsp/\"), exploiting Java File API behavior that drops trailing slashes. The upstream fix (commits b7e0435d17 and b577f9a799, September 2017) was already present in Apache Tomcat 10.1.33 (released November 2024) before TuxCare onboarding. The fix rejects file operations when paths end with \"/\", preventing path manipulation. Fix authored by Mark Thomas (markt@apache.org), not TuxCare/CloudLinux. Verdict: not_affected (upstream fix in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:151065a6-fa18-51f4-b399-2c7f941bc19e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5648 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Apache Tomcat 10.1.33. The vulnerability involved application listeners receiving raw internal request/response objects instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The fix (using request.getRequest() to pass facades instead of raw objects) was applied by upstream Apache in March 2017 and is present in all affected files in version 10.1.33. When TuxCare onboarded this version, the fix was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:48b8b382-e2d5-54a1-bd2e-616d30c20366",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects Tomcat 7.0.0-7.0.93, 8.5.0-8.5.39, and 9.0.0.M1-9.0.0.17 due to XSS in the SSI printenv command when it echoes variables without HTML entity encoding. The target (Tomcat 10.1.33) is not affected because the upstream fix by Mark Thomas (commit 15fcd166ea, 2019-03-11) was already present when TuxCare onboarded version 10.1.33 in October 2026. The SSIPrintenv.java file uses S...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-9484",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9d887b96-bda8-5825-9f72-e372e8f8d6fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-9484 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2020-9484 is NOT present in Apache Tomcat 10.1.33. The vulnerability (path traversal in FileStore allowing arbitrary file deserialization) was fixed by upstream Apache in commits bb33048e3f9b (May 5, 2020) and 70da1aaa51e (January 12, 2022), both authored by Mark Thomas. Both commits were already present in the Apache Tomcat 10.1.33 release when TuxCare onboarded it on October 7, 2026. The fix validates that file paths constructed from session IDs remain within the designated storage directory (FileStore.java lines 303-306), preventing path traversal attacks that could lead to deserialization of attacker-controlled files and remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:00d68924-dd4a-5dc8-899f-0875fdfbd1eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2022-45143 affects JsonErrorReportValve in Apache Tomcat when type, message, or description values are not escaped before being concatenated into JSON output, allowing JSON injection. The target repository (Apache Tomcat 10.1.33) is NOT AFFECTED because the fix was already present in the upstream 10.1.33 release. The JSONFilter.escape() method and its usage in JsonErrorReportValve were introduced by upstream Apache committer Mark Thomas (markt@apache.org) in commit 1f50bff8daabb48c5f15398689988f26aac6ec56, which was included in Apache Tomcat releases from 10.1.10 onwards. TuxCare onboarded version 10.1.33 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1376cd80-01f4-52ed-8166-4398c99d40ca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2023-24998 (Apache Commons FileUpload DoS via unbounded request parts) is NOT a vulnerability in this target. The fix was already present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The fileCountMax limit enforcement is fully implemented in FileUploadBase.java (lines 118, 206-217, 315-318) and properly configured in Request.java (line 2599). The fixing commit (8a2285f13af) was authored by upstream Apache developer markt@apache.org on 2023-01-03 and shipped in the 10.1.33 release before TuxCare's onboarding commit (47a79a9e4c). The vulnerable pattern (unbounded accumulation of multipart request parts) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28708",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d727d08a-baac-557d-bc10-5ba19fad5aca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Apache Tomcat 10.1.33-tuxcare.2 is not affected by CVE-2023-28708. The vulnerability fix was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded (commit 47a79a9e4c). The upstream fix (commit f509bbf31f by lihan@apache.org) addresses the issue by ensuring RemoteIpFilter properly propagates the secure channel status to the underlying request object via a special ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2c319369-07c4-5a69-b806-855e917ff05d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) is not present in Tomcat 10.1.33. The fix preventing protocol-relative redirects was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable pattern never existed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81881194-175f-5e5e-b9dd-09fc1aaf7c53",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:77575065-509d-57d1-ba3c-ef9d7878fd58",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Target version 10.1.33 is not affected by CVE-2023-46589. The upstream Apache Tomcat 10.1.33 release already included a refactoring that consolidated HTTP header and trailer parsing into a common HttpHeaderParser class (commits a5a7c11250 and 92e3c7a7ad by Mark Thomas, April 2024). This parser includes the exact character validation logic that CVE-2023-46589 patches added to earlier Tomcat versions: header names must be valid HTTP tokens, and header values must not contain control characters except tab. The vulnerable pattern (missing trailer header validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-50379",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7d6ba56e-89fd-51f5-975f-f4a324096f38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-50379 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2024-52316",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81ed90c2-86d1-5927-8def-148a8015584c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2024-52316 does not affect Apache Tomcat 10.1.33. The vulnerability (unchecked error condition in Jakarta Authentication that could allow authentication bypass when ServerAuthContext throws an exception without setting HTTP status) was fixed by upstream Apache in version 10.1.31. The target version 10.1.33 includes the upstream fix (commit acc2f01395 by Mark Thomas) which explicitly sets HTTP 500 status when validateRequest() throws an AuthException. The fix is present in AuthenticatorBase.authenticateJaspic() in java/org/apache/catalina/authenticator/AuthenticatorBase.java.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-56337",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f97169af-6ccc-500d-a965-d0e35852ee3c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-56337 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-24813",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:eeaa6225-0dd9-5a3e-b406-5460e362e6e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-24813 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.2."
      }
    },
    {
      "id": "CVE-2025-31651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ef3f7516-ffed-5958-91a8-f2c8e123520e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-31651 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.2."
      }
    },
    {
      "id": "CVE-2025-46701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b54ba60c-ee59-54c8-a95c-e01331e2e90b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-46701 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-48988",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a1aeb9d5-260b-51a1-8ba6-51d6e1c84665",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-48988 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76023f49-203d-548b-bf2d-6b4d3f88a031",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-49124 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2025-49125",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:63bf7dfb-8b89-5fa9-a19e-6158076aa793",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-49125 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.2."
      }
    },
    {
      "id": "CVE-2025-52520",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6b0dfab5-c342-598f-87dd-5442461ea18d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55668",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:18ef8dcc-8812-53e4-965c-dbf5f0826d03",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55668 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13c20a3c-fb53-5327-9a9c-9cece2d1bc9e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55752 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:734057e8-b20c-5392-a5ae-d78e71fb57f2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e2c30932-8fb6-599a-9a5f-57cf42af44c4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a98e59f2-87c5-5582-b1df-846121e122ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c1492897-118a-55f5-8ff9-dda32c456a50",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34483 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:06dad434-9bd9-57fe-bf1b-801259269862",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e69f9bea-9cbe-52a2-b49b-c5d2a6f5bd99",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6527264f-9814-5957-a8c6-e892e233f657",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8c8c1331-2bc3-5448-b448-91b5cb55e014",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:370cebdd-9200-5e5b-a910-d21031e0e0ee",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dce85f39-fd64-55fd-a41c-31a41582ea22",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0b9a4d6a-fd2f-5073-a4eb-2041d90b1439",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:062fc5cc-1f17-5b72-a9b2-e8ec2c6fb337",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5ba2df4e-b7a8-5b43-bb29-3d366f072c2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:67454ff5-7356-587c-a964-4c36e6010519",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e63cb9aa-61c0-54e2-86cb-95298dc5cb01",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65905 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.33-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:39805ef3-4a50-53fe-bc09-f3f7345b1116",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-catalina."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33-tuxcare.1"
    }
  ]
}