{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a72567f2-30ae-56f7-8ef2-e99d347f87fb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2",
      "version": "10.1.50-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5388",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6a5f5900-51d5-5233-bb4e-9c9f5605cf81",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5388 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is not present in Tomcat 10.1.50. The upstream fix (commit fb3569fbb9 by Mark Thomas, 2016-08-19) was already included in the upstream release 10.1.50 when TuxCare onboarded it. The vulnerable blacklist approach (excluding only AUTHORIZATION/PROXY_AUTHORIZATION headers) has been replaced with a secure whitelist pattern that prevents arbitrary HTTP headers, including \"Proxy\", from being passed to CGI processes as environment variables.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8ac5b7f1-3159-59bc-a15e-c71a72cd786a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.50 is not affected by CVE-2016-8735. The vulnerable component JmxRemoteLifecycleListener.java does not exist in this version. The class was deprecated in December 2019 and completely removed from Tomcat in January 2022 (commit 1b9e8fd1f4 by upstream Apache developer Mark Thomas), before the Tomcat 10.1.x series began (first release 10.1.0 on 2022-09-26). The entire 10.1.x line never contained this vulnerable component. No alternative JMX remote RMI server implementation exists in the target that could exhibit the same deserialization vulnerability pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7de313d6-00c2-5320-8fb8-c28b56d71e6d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12616 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects FileDirContext and VirtualDirContext classes in Tomcat 7.0.0-7.0.80, which allowed path traversal via direct File construction without validation. These classes do not exist in Tomcat 10.1.50 - they were architecturally replaced in Tomcat 8.0 by the WebResourceRoot/WebResourceSet framework. The new architecture has canonical path validation built-in from inception (AbstractFileResourceSet.file() lines 73-163), preventing the vulnerability pattern. No vendored copies exist, no git commits reference this CVE, and exhaustive searches confirm the vulnerable code is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12617",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6478b4ca-c98e-5f50-8785-f1a0d2bfb79f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12617 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is not present in the target. The vulnerability allowed uploading JSP files via HTTP PUT requests with trailing-slash paths (e.g., \"shell.jsp/\") that would normalize to executable paths without the slash. Apache Tomcat fixed this in commits b7e0435d17 and b577f9a799 (authored by Mark Thomas, markt@apache.org) by adding two defenses: (1) rejecting file writes when path ends with \"/\" in DirResourceSet.write():270-272, and (2) rejecting file reads when path ends with \"/\" but resolves to a file in AbstractFileResourceSet.file():83-85. Both fixes are present in the target Tomcat 10.1.50 and were included in the upstream release that TuxCare onboarded (first TuxCare commit: 8f04542b9a by amoniatovskiy@cloudlinux.com). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7621e2d1-4ab8-5492-9ed7-535bca86cfe8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5648 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is not present in Tomcat 10.1.50. The vulnerability affected Tomcat 7.x/8.x/9.x where application listeners received internal request/response objects instead of facades, allowing untrusted applications to access cross-application data under SecurityManager. The upstream fix (commit dfa4086342, March 2017) modified three files to use request.getRequest() when firing application listeners. This fix was already included in upstream Tomcat 10.1.50 when TuxCare onboarded the version (commit 8f04542b9a). All affected code locations (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use facade objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:416d048a-c4e3-5240-a1e0-42cbc1235405",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 10.1.50. The vulnerability concerned the SSI printenv command echoing environment variable values without HTML escaping, enabling XSS attacks. The upstream fix (commit 15fcd166ea by Mark Thomas, 2019-04-09) was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The current code at SSIPrintenv.java:38 properly applies HTML entit...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-9484",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9665ca69-2971-54c0-9aa7-3869514155e4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-9484 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2020-9484 is not present in Apache Tomcat 10.1.50. The vulnerability, which allowed path traversal in session IDs to deserialize arbitrary files via FileStore, was fixed by Apache upstream in May 2020 (commit bb33048e3f). This fix was already included in version 10.1.50 when TuxCare onboarded it in September 2026. The FileStore.java file contains complete path validation at lines 324-328 that prevents session IDs with path traversal sequences from accessing files outside the configured storage directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:689fbe55-ab29-5d28-afab-01e3183e38d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2022-45143: The target is NOT affected. The vulnerability (missing JSON escaping in JsonErrorReportValve for type/message/description fields) was fixed by upstream Apache Tomcat in commit 1f50bff8daabb48c5f15398689988f26aac6ec56 (author: Mark Thomas, markt@apache.org, Nov 9 2022). This fix was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it via commit 8f04542b9a2881ccb651bfb2518a0f2745687b8c. The current HEAD contains JSONFilter.escape() protecting all three vulnerable fields, eliminating the JSON injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2cfbe52d-a46f-5f87-9efb-d1f2a2ac91c2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2023-24998 fix is present and active in Apache Tomcat 10.1.50. The vulnerability concerns unbounded processing of multipart/form-data request parts leading to DoS. The upstream fix adds a fileCountMax limit with default enforcement via maxParameterCount (10,000 parts). This fix was included in the upstream Apache Tomcat 10.1.50 release (committed Dec 13, 2022 by markt@apache.org) before TuxCare onboarded the version on Sep 20, 2026 (commit 8f04542b9a). No separate TuxCare backport was needed for 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28708",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c1919a0e-8912-5fed-97a6-087447eb734e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 The target (Tomcat 10.1.50) is not affected by CVE-2023-28708. The vulnerability pattern has been removed by an upstream fix (commit f509bbf31fc) that was already present in the upstream 10.1.50 release when TuxCare onboarded it. The fix ensures that when RemoteIpFilter processes X-Forwarded-Proto: https headers, it properly propagates the secure state to the underlying Request object via a spe...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:15b5fb5a-f953-5333-976b-b84c120481a7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.50. The fix was already included in the upstream Apache Tomcat 10.1.50 release (commit bb4624a9f3 by Mark Thomas, dated Aug 22, 2023) before TuxCare onboarded this version. The vulnerable pattern - lack of protection against protocol-relative redirects (URLs starting with //) in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:192bd2a0-d7d2-5d13-9343-a65298125b9b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fabb0ff8-e66b-5dea-80f1-7c2fa17d3ca2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.50 is not vulnerable to CVE-2023-46589. The target version is after the fixed version 10.1.16. The vulnerability (improper HTTP trailer header validation leading to request smuggling) is not present because the target uses a refactored HttpHeaderParser class introduced by upstream Apache in April 2024 that includes the required validation. The fix was part of the upstream 10.1.50 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-50379",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0aedec6c-c64e-59d4-9b9a-e7b4f5f5fe10",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50379 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.50 (target version) shipped with the complete CVE-2024-50379 fix already applied by upstream. The vulnerability pattern (TOCTOU race during JSP compilation on case-insensitive filesystems) is not present because the upstream release included comprehensive locking (WebResourceLockSet interface, ReentrantReadWriteLock on normalized/lowercased paths) that prevents concurrent file access corruption. TuxCare onboarded an already-fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52316",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6c12218c-cea7-5650-b30a-41659f1e9027",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target is Apache Tomcat 10.1.50. CVE-2024-52316 (Unchecked Error Condition in Jakarta Authentication / JASPIC) affects 10.1.0-M1 through 10.1.30 and is fixed in 10.1.31. The target (10.1.50) already ships the upstream fix natively. The upstream patch (commit acc2f01/7532f9dc, \"If the Jakarta Authentication fails with an exception, set a 500 status\") adds an explicit response.setStatus(SC_INTERNAL_SERVER_ERROR) in the AuthException catch block of AuthenticatorBase.authenticateJaspic(), so a custom ServerAuthContext that throws during validateRequest() can no longer leave the request in a non-failure state (authentication-bypass). That exact fix is present in the target at java/org/apache/catalina/authenticator/AuthenticatorBase.java lines 806-807. git blame attributes those lines to upstream Apache commit acc2f01395f895980f5d8a64573fcc1bade13369 by Mark Thomas <markt@apache.org>, and git show confirms the fix already exists at the upstream 10.1.50 tag (cd6d685800), which is a direct parent of HEAD. No TuxCare backport branch for this CVE targets 10.1.50 (backports exist only for older versions). Verdict: not_affected (upstream vendor fix baked into the shipped version); justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-56337",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:99028178-2e9f-588e-920f-d328c408f29c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-56337 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target Tomcat 10.1.50 is NOT affected by CVE-2024-56337. The complete upstream fix authored by Mark Thomas (markt@apache.org) was already present in the Apache Tomcat 10.1.50 release when TuxCare onboarded it. The fix includes: (1) runtime checks in DirResourceSet.initInternal() that verify canonical caches are disabled on vulnerable configurations and prevent startup if they cannot be disabled, (2) JreCompat methods isCanonCachesDisabled() and disableCanonCaches() using reflection to access java.io.FileSystem.useCanonCaches, and (3) startup scripts (catalina.sh/catalina.bat) that set -Dsun.io.useCanonCaches=false by default. The vulnerable pattern (uncontrolled canonical path caching on case-insensitive filesystems with write-enabled default servlet) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-24813",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:baf893e5-03be-5f3a-9c2c-1c42064ce921",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-24813 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-24813 (Path Equivalence via Internal Dot in partial PUT temp files) is NOT present in the target. The vulnerable pattern\u2014predictable temporary file naming using path.replace('/', '.')\u2014was already fixed in the upstream Apache Tomcat 10.1.50 release. The target uses File.createTempFile() to generate unpredictable random temp file names and deletes them immediately after processing, implementing both security measures from the upstream patch authored by remm@apache.org on 2025-01-24.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:75f9970b-ef4a-5c04-93f6-c9130e74e146",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31651 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-31651 affects Apache Tomcat's RewriteValve, where URLs containing literal '%', ';', or '?' characters could bypass rewrite rules due to improper handling of escape sequences. The target repository (Apache Tomcat 10.1.50) is NOT AFFECTED because the upstream Apache fix (commit 066bf6b6a15 by Mark Thomas, dated 2025-03-13) was already included in the 10.1.50 release when TuxCare onboarded it. The fix adds an encodeForRewrite() method that pre-encodes literal special characters before rewrite rule evaluation, preventing bypass attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-46701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d224de38-82e0-5a54-810a-42d190c6f813",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-46701 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-46701 does not affect Apache Tomcat 10.1.50-tuxcare.2. The vulnerability fix was already present in the upstream Apache Tomcat 10.1.50 release when TuxCare onboarded it. The target code contains the security fix (isFile() validation in CGIServlet.findCGI) introduced by upstream commit 238d2aa54b (Mark Thomas, 2025-05-02), which predates the TuxCare onboarding commit 8f04542b9a (2026-09-20). Version 10.1.50 exceeds the first fixed version 10.1.41 specified in the CVE advisory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48988",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f9a18bf1-0e95-5bb4-b9e2-935277fa64e9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48988 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-48988 is NOT present in Apache Tomcat 10.1.50. The upstream fix that adds maxPartCount and maxPartHeaderSize limits to prevent resource exhaustion during multipart request processing is already present in the target version. The fix was authored by Mark Thomas (Apache upstream) in commit cdde8e655bc1c5c60a07efd216251d77c52fd7f6 and is part of the 10.1.50 release.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aeff3248-6a25-57eb-831f-f12fe777cfda",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49124 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-49124. The upstream fix (commit e0e0781222 by Mark Thomas) that adds full path $SYSDIR\\ prefix to all icacls.exe calls was already included in the Apache Tomcat 10.1.50 release. TuxCare onboarded version 10.1.50 which already contained this upstream security fix. All three icacls invocations in res/install-win/tomcat.nsi (lines 382, 395, 408) correctly use '$SYSDIR\\icacls' instead of the vulnerable bare 'icacls' pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49125",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec704bb8-fe87-565e-b5eb-089b52b88ff1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49125 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target version 10.1.50 already contains the upstream Apache Tomcat fix for CVE-2025-49125. The vulnerable path.startsWith(webAppMount) pattern has been replaced with the secure isPathMounted() method that enforces proper path boundary checking. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 7617b9c247bc77ed0444dd69adcd8aa48777886c and was included in upstream version 10.1.42. Since 10.1.50 > 10.1.42, the fix was already present when TuxCare onboarded this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-52520",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c02f4644-87c4-52ef-9240-21341857dbb8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52520 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-52520 (Integer Overflow in Apache Tomcat multipart upload) is NOT present in target version 10.1.50. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.42 and was fixed in 10.1.43. The target version 10.1.50 was released upstream AFTER the fix was applied (fix date: 2025-07-01; onboarding date: 2026-09-20). The fix (changing int postSize to long postSize with Math.addExact overflow detection) was already present in the upstream Apache Tomcat 10.1.50 release when TuxCare onboarded it. Fix commit fc42bbccb9041fafd194fbfdf3eab1d44cb5c45c by upstream author Mark Thomas (markt@apache.org) is confirmed present at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107; >= 10.1.0, < 10.1.43; >= 11.0.0, < 11.0.9), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55668",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:16d3d47e-2438-5eb8-807c-88541542340f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55668 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target Apache Tomcat 10.1.50-tuxcare.2 is not affected by CVE-2025-55668. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and the target version 10.1.50 already contains the complete upstream fix. The fix (commit 8621e4c6ba by remm@apache.org) was shipped in the upstream 10.1.50 release that TuxCare onboarded, not backported by TuxCare. Both critical components of the fix are pre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:79667b04-a18e-5519-9f57-12dd92196cd0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target Tomcat 10.1.50 repository is NOT AFFECTED by CVE-2025-55752. The vulnerability involved incorrect URL processing order in RewriteValve where normalization occurred before decoding, allowing attackers to bypass security constraints for /WEB-INF/ and /META-INF/ using percent-encoded paths. The fix (decode-then-normalize) was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded, authored by Mark Thomas (markt@apache.org) in commit 130d36d8492ef9e4eb22952c17c92423cb35fd06. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a9328ef8-e437-5b3c-a400-98babda20419",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55754 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-55754 is NOT present in Tomcat 10.1.50. The vulnerability (ANSI escape sequences in log messages allowing console manipulation) was fixed by upstream Apache in commit 138d7f5cfa which added LogUtil.escape() to sanitize control characters. This fix was already included in the Apache Tomcat 10.1.50 release that TuxCare onboarded. The defense escapes all control characters (except tab, newline, carriage return) to Java \\uNNNN format before writing to log output, preventing console manipulation attacks. Fix author: Mark Thomas <markt@apache.org> (upstream Apache, not TuxCare backport).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fda4b485-1256-59f5-a1e4-3831d4beef6c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-61795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 The target Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-61795. The vulnerability (temporary file accumulation from failed multipart uploads) has been fixed by upstream Apache Tomcat. The fix commit af6e918162 by Mark Thomas (markt@apache.org) was included in the upstream 10.1.50 release that TuxCare onboarded. The CVE states versions 10.1.47+ are fixed, and 10.1.50 meets this requirement. The def...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7ab4bca8-4347-5374-b34c-6520fab746aa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:426255ca-00f5-5709-bce0-a0477a378bb0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:337cc861-4f8c-5e5c-a4bb-2cf3b1172913",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ac1aa1c0-f768-5d46-b486-e7390b3e8967",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a8eaf79d-2831-5f43-998e-416a4f679f07",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.50-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4277ff60-77a2-50cc-93e9-8bbb93585ead",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:051d0381-7bef-59f2-8a94-4494c0ad7cdf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a39b08a8-89c4-55b9-8fc8-250beb7caa43",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.50-tuxcare.4."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4ea42bf5-a919-59e9-8f28-18d3ce73bae7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ab7f6c17-24c8-5ed4-abd2-b436b2dcae80",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:51df8814-1e82-54f4-8e7c-a5edbb083030",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6629d19e-d421-5291-a2a3-1eaaeadc20f3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2126e7d6-0ac6-538a-accb-50f306504192",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:050d880c-409a-52ce-8a7e-e8e8a97ab7d3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.50-tuxcare.2"
    }
  ]
}