{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c477acb2-83fd-5658-8cd7-e6d7df7ce433",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11",
      "version": "10.1.42-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.42"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5388",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dcea4ae2-2a22-56fb-a1f2-589d339a9afd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5388 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.42-tuxcare.11 is NOT affected by CVE-2016-5388 (httpoxy). The vulnerable code pattern (blacklist approach that allowed the Proxy header to be passed as HTTP_PROXY environment variable to CGI processes) was replaced by a secure whitelist defense in upstream commit fb3569fbb9 (2016-08-19) by Apache committer Mark Thomas. This fix was already present in the upstream Tomcat 10.1.42 release that TuxCare onboarded, with 9,432 commits (8 years) between the fix and the TuxCare setup commit. The CGIServlet now only passes whitelisted headers (ACCEPT*, CACHE-CONTROL, COOKIE, HOST, IF-*, REFERER, USER-AGENT) to CGI processes, excluding the Proxy header by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:c1421d48-829e-5000-84c2-095424013f89",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects Apache Tomcat's JmxRemoteLifecycleListener component, which allowed remote code execution via deserialization of malicious credential objects when JMX ports were accessible. The target Tomcat 10.1.42 is NOT AFFECTED because the entire JmxRemoteLifecycleListener class was removed from Tomcat 10.x by Apache maintainers before the 10.1.0 release. The component was deprecated in December 2019 as its functionality was superseded by built-in JRE JMX capabilities, then completely removed in January 2020 (commit 46fbf32e55). This removal was part of the upstream release that TuxCare onboarded, eliminating the vulnerable code path entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0073801a-03fc-5f0f-9099-2d3472d31ebc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12616 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects Apache Tomcat 7.0.0-7.0.80's VirtualDirContext component, which allowed directory traversal via specially crafted requests due to unvalidated file path operations. The target (Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED because VirtualDirContext was replaced by the WebResourceRoot/WebResourceSet architecture, which has built-in canonical path validation in AbstractFileResourceSet.file() (lines 108-114) that prevents directory traversal by checking that resolved paths stay within the canonicalBase directory. This validation is active by default (allowLinking=false) and applies to all resource access operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2017-12617",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:051311f2-acc7-5d8e-bf51-9e8d325f6dbe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12617 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 10.1.42 is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes when readonly=false. Both defensive fixes (write-side and read-side protections against paths ending with \"/\") are present in the target and were shipped in the upstream Apache Tomcat 10.1.42 release. The fixes were authored by the upstream maintainer Mark Thomas (markt@apache.org) and integrated before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0b46e1b6-995a-5eba-8c3b-b353cc64db3b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5648 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability involved application listeners receiving internal Request/Response objects instead of secure facade wrappers, allowing untrusted code to access data from other web applications. The fix was already present in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() facade when calling fireRequestInitEvent() and fireRequestDestroyEvent(), preventing direct access to internal request/response state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6d368b42-d371-5d8a-9952-ae61ffbb6a34",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 (SSI printenv XSS) is not present in Tomcat 10.1.42. The fix (commit 15fcd166ea by Mark Thomas) was already included in the upstream Apache Tomcat 10.1.42 release before TuxCare onboarded this version. The vulnerable pattern (unencoded variable output) is absent because SSIPrintenv.java:41 uses `getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)`, which applies HTML entit...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-9484",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:807af4f2-d485-5683-8de0-4316a61d19fc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-9484 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. CVE-2020-9484 affects Apache Tomcat versions 10.0.0-M1 to M4 (and earlier 9.x, 8.5.x, 7.x versions). The vulnerability allows remote code execution via deserialization when an attacker can control a session ID to reference files outside the FileStore storage directory. Version 10.1.42 is NOT affected because the upstream fix (commit bb33048e, dated May 5, 2020) that adds path validation to FileStore.file() was already present in the release before TuxCare's first commit. The fix validates that canonicalized file paths remain within the storage directory boundary, blocking path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:82329758-e8bc-5dc8-8c06-5d6e44302371",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 10.1.42-tuxcare.11 is NOT affected by CVE-2022-45143. The vulnerability (JSON injection via unescaped type/message/description fields in JsonErrorReportValve) was fixed in upstream commit 1f50bff8 by Mark Thomas on 2022-11-09, which was already present in the upstream 10.1.42 release when TuxCare onboarded it on 2026-03-11. The fix uses JSONFilter.escape() to properly escape control characters, quotes, and backslashes in all user-controlled strings before embedding them in JSON output. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:30597348-19ec-5312-9f53-0799b850f98b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. CVE-2023-24998 is NOT present in Apache Tomcat 10.1.42. The vulnerability concerns unbounded processing of multipart file upload request parts leading to DoS through resource exhaustion. The fix adds a fileCountMax limit that throws FileCountLimitExceededException when exceeded. The complete fix was already present in the upstream Apache Tomcat 10.1.42 release (commit 8a2285f13a by Mark Thomas, Dec 13 2022) before TuxCare began maintaining this version. All defense components are present: FileCountLimitExceededException class, fileCountMax field in FileUploadBase, count check before processing each part (lines 457-459), Request.java configuration (line 2646), and Parameters.size() method (lines 122-124). The vulnerable pattern (unbounded part processing without count limit) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28708",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:1afc58f7-63f2-5cd3-a2aa-c05d209bcc95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-28708 is NOT present in Tomcat 10.1.42. The vulnerability affects Tomcat 10.1.0-M1 to 10.1.5, where RemoteIpFilter failed to propagate the secure flag to the underlying request object when X-Forwarded-Proto: https was present, causing session cookies to be created without the Secure attribute. The upstream fix (commit f509bbf31fc by lihan@apache.org) was released in Tomcat 10.1.6 on Fe...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9f4688da-e527-5464-b62a-9df29155daa5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in target version 10.1.42. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The defense code (lines 766-769 in FormAuthenticator.java) strips consecutive leading slashes from saved request URLs, preventing protocol-relative redirect interpretation (e....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a15aff89-d539-5515-a927-19e31fc9287f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:fc23571b-d4c2-58c5-a06e-005f988efa51",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.42 is not affected by CVE-2023-46589. The vulnerability involves improper validation of HTTP trailer headers in chunked transfer-encoded requests, which could lead to request smuggling. According to the CVE, versions 10.1.16 onwards contain the fix. The target version 10.1.42 already includes the upstream fix that validates trailer header names using HttpParser.isToken() and trailer header values to reject control characters. The fix was authored by Mark Thomas (Apache committer) and shipped in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-50379",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:44579d35-eed0-5148-8b51-e6671aebec7f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50379 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. Target version 10.1.42-tuxcare.11 is NOT AFFECTED by CVE-2024-50379. The vulnerable pattern (unsynchronized resource access causing FileResource metadata corruption on case-insensitive filesystems) is not present. The complete upstream fix was included in Apache Tomcat 10.1.42 before TuxCare onboarded it. Both the main fix (commit 8554f6b172 adding read/write locks with normalized, case-folded path keys) and follow-up fix (commit 05ddeeaa54 ensuring ResourceLock is added to map) were authored by Mark Thomas (markt@apache.org) and shipped in the upstream release. The fix protects all three critical operations: getResource(), write(), and delete().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52316",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:62efd5eb-f888-5ac2-8f68-63d1897e4f82",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. already_fixed \u2014 CVE-2024-52316 affects Apache Tomcat versions 10.1.0-M1 through 10.1.30. The target repository is version 10.1.42, which is newer than the first fixed version (10.1.31) in the upstream Apache Tomcat 10.1.x series. The fix is present in the current code at AuthenticatorBase.java lines 804-808, where exceptions from Jakarta Authentication validateRequest() are caught and explicitly set HTTP status 500 to ensure authentication failures are properly handled.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-56337",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:f6ab72b2-75f5-5da8-9765-2ffd449da024",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-56337 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. CVE-2024-56337 does not affect this target. The vulnerability patterns are not present because the fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The CVE affects versions 10.1.0-M1 through 10.1.33, and the fix was released in 10.1.35+. The target version 10.1.42 includes both the locking mechanism (from CVE-2024-50379) and the canon cache checks (CVE-2024-56337 specific) authored by upstream Apache Tomcat maintainers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-24813",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:08848340-8e75-54d9-a51d-64ad7f17ebb9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-24813 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. Target Apache Tomcat 10.1.42 is not affected by CVE-2025-24813. The vulnerability involving predictable temporary filenames in DefaultServlet's partial PUT handling was fixed in upstream commit f6c01d6577 (Jan 24, 2025) by remm@apache.org. This fix was already present in the upstream 10.1.42 release before TuxCare onboarded it (first TuxCare commit 39e58930c6 on Mar 11, 2026). The vulnerable pattern (convertedResourcePath = path.replace('/', '.')) is absent from HEAD; the secure pattern (File.createTempFile) is present with proper cleanup in the finally block.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ebdcd8d8-0f84-59bb-91cc-2fe8db5058fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31651 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. The target (Tomcat 10.1.42) is not affected by CVE-2025-31651. The vulnerability allowed bypassing rewrite rules via specially crafted URLs containing literal '%', ';', or '?' characters that were confused with structural delimiters. The fix was already present in upstream Apache Tomcat 10.1.42 when TuxCare onboarded it. The fix adds encodeForRewrite() to encode literal special characters before rewrite rule evaluation, and removes semicolon-stripping code from CoyoteAdapter. Fix commit 066bf6b6 authored by Mark Thomas (Apache) is an ancestor of the onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-46701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:2d59ea20-2459-5151-a339-8a3014574d31",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-46701 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2025-46701. The vulnerability involved improper case sensitivity handling in the CGI servlet's findCGI() method, where File API-based path resolution (case-insensitive on Windows/macOS) could bypass case-sensitive security constraints. The upstream fix refactored the code to use WebResource API with explicit isFile() checks, providing consistent case-sensitive URL-based path resolution. This fix (commits 238d2aa5 and 2c68001 by Mark Thomas) was already present in Apache Tomcat 10.1.42 when TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48988",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a5785188-53ec-5dc0-9493-35f555caed00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48988 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. 10.1.42 is the first fixed release in 10.1.x. The fix is already included in 10.1.42.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cab68da6-0427-5067-9ae7-a8eef68da2ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49124 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT vulnerable to CVE-2025-49124. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and this fix was already present when TuxCare onboarded the 10.1.42 release. All three icacls.exe invocations in the Windows installer script (res/install-win/tomcat.nsi at lines 382, 395, 408) use the full system path ($SYSDIR\\icacls) instead of relying on PATH search, preventing untrusted search path attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49125",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:136692d2-6638-5f8c-8953-bfdae84e3331",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49125 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. 10.1.42 is the first fixed release in 10.1.x. The fix is already included in 10.1.42.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-52520",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e95b4d8d-3b14-5dd3-8bcf-1fd89ca3783c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55668",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:155bd058-2a0d-55be-a037-d73329c9dc4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55668 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 The target Apache Tomcat 10.1.42-tuxcare.11 is NOT AFFECTED by CVE-2025-55668. The vulnerability (session fixation via RewriteValve failing to encode session IDs in redirect URLs) was fixed in upstream commit 8621e4c6ba by remm@apache.org on June 3, 2025. This fix was already present in Apache Tomcat 10.1.42 when TuxCare onboarded it on March 11, 2026 (commit 39e58930c6). All three protective c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4f7f68a5-2470-5341-ace8-f5315ed64506",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cdde9700-db9e-516f-bb96-f2a04725a4ad",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:57eebee0-64bb-5f0b-bc3d-4edda56d2813",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:94de9221-2089-5366-b25e-ea18779cecae",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6b950ce9-a394-5330-abeb-4346fe695581",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:72d35d5d-703e-5c19-a541-332b7208f67f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:f2b55856-5efb-5bc9-9bbe-fcdcabe8ac60",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:78990225-d270-5446-b2d8-1b499bee2966",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dc0d3ca9-1141-5dd1-ac1f-8f5ea11feabd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e7c71d62-97a5-52d9-a8f7-4e875c50cc51",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:7b30e766-3eed-5a45-bd06-454d6b7ea40d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cfc568ba-ec81-5d51-b032-2a7b82fa7996",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:071bbc15-074a-51ef-b462-ba8326391218",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:48968482-90bb-5733-9792-6fea082826eb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:795ee151-9267-597d-9cbc-493bb5fdfdd5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:89e91186-65ce-5f37-81ec-0f9ec1f5bf16",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:991dbf93-68eb-5176-aba8-ebffb55256b5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-catalina."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.42-tuxcare.11"
    }
  ]
}