{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3889d07d-4c06-5d00-9278-e7b8abbb1a32",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10",
      "version": "10.1.18-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:fad61ae7-2341-5204-8f91-5a8872c138ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The vulnerability is not present in Tomcat 10.1.18. CVE-2014-0095 affected Tomcat 8.x before 8.0.4 (fixed March 2014 by Apache upstream). The fix explicitly handles Content-Length: 0 in AJP requests to prevent thread hangs. Between Tomcat 8.x and 10.x, Apache refactored the AJP code from AbstractAjpProcessor to AjpProcessor, carrying the fix forward. The target version 10.1.18 inherited the fix...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:347b3581-2f8a-5e8c-a4a2-6b17e432bb69",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is not present in Apache Tomcat 10.1.18. The upstream fix for invalid character validation in HTTP request line parsing was already included in the Apache Tomcat 10.1.18 release that TuxCare onboarded. The fix adds character validation for both request targets and HTTP protocol versions per RFC 7230/3986, rejecting control characters, non-ASCII characters, and specific special characters that could enable HTTP response injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8; >= 8.0.0RC1, < 8.0.39; >= 7.0.0, < 7.0.73; >= 6.0.0, < 6.0.48), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 8.0.0; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6; >= 8.0.0.RC1, <= 8.0.38; >= 7.0.0, <= 7.0.72; >= 6.0.0, <= 6.0.47; < 6.0.0), Snyk (>= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1ec3d54b-1861-56c7-bb70-caee8ad2916c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 concerns a race condition in Apache Tomcat's sendfile processing where the Processor could be added to the processor cache twice when sendfile completed quickly, leading to the same Processor being reused across multiple requests and causing response mix-up. The target repository (Tomcat 10.1.18) is NOT AFFECTED because the upstream Apache fix (commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8, dated 2017-03-24, fixing bug 60918) was already present in the upstream release when TuxCare onboarded this version. The fix introduces explicit SendfileState tracking to prevent premature processor recycling. All fix elements are present in the target code: SendfileState enum usage, explicit state tracking in the keep-alive loop, processSendfile() method returning SendfileState, and correct return logic checking sendfileState == SendfileState.PENDING rather than sendfileData nullability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:57847e5a-b089-5390-a80c-603df7419716",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. Target Tomcat 10.1.18 is not affected by CVE-2019-0199. All three defense mechanisms (stream read timeout, stream write timeout, and overhead frame tracking) are present and active by default. The vulnerable pattern (indefinite blocking on stream I/O without timeouts or overhead limits) is not present. These fixes were introduced by Apache in upstream commits around February 2019 for Tomcat 8.5.38+ and 9.0.15+. Version 10.1.18 already contained all fixes when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:3938eceb-2524-5e7e-a8e3-0294cbdf3089",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 (h2c direct connection memory leak) is NOT present in Apache Tomcat 10.1.18. The vulnerability was fixed upstream by Mark Thomas in commit c9167ae30f3b03b112f3d81772e3450b7d0e6a25, which shipped in the Apache Tomcat 10.1.18 release before TuxCare onboarded this version. The fix adds a release(processor) call to recycle the HTTP/1.1 processor before creating the HTTP/2 upgrade processor, preventing memory exhaustion. The vulnerable pattern (missing processor release) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:683fcb53-6c5c-57ad-9140-12f069740b00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2020-13943 is NOT present in Tomcat 10.1.18. The vulnerability affects earlier Tomcat versions (10.0.0-M1 to M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57) where exceeding max concurrent HTTP/2 streams could cause header confusion between requests. The fix (commit 1bbc650cbc by Mark Thomas) moved the concurrent stream limit check from headersStart() to headersEnd(), ensuring the check occurs AFTE...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:65b39966-e9d9-5b60-b48a-fe6a9b70f5ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. The target repository (Apache Tomcat 10.1.18) is not affected by CVE-2020-17527. The vulnerability, which involved HTTP/2 request header value re-use between streams due to shared mutable state in HPACK decoding, was fixed by upstream Apache before the 10.1.18 release. The fixes include: (1) replacing a shared StringBuilder instance field with method-local instances in HpackDecoder.java, and (2) using ConcurrentHashMap instead of EnumMap in ConnectionSettingsBase.java for thread-safe concurrent access. Both fixes were authored by Mark Thomas (markt@apache.org) in November 2020 and January 2021, predating the 10.1.18 release (November 2022).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:bcb7a629-0cb5-500d-a4ef-c27139107b20",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61. The target version 10.1.18 is significantly later than the affected range. All three fix components for this vulnerability (local StringBuilder instances in HpackDecoder, ConcurrentHashMap in ConnectionSettingsBase, and proper processor recycling in AbstractProtocol) were already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The vulnerable code patterns (shared mutable state causing cross-request data leakage) are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:04d4f889-06f6-54e7-95e1-f10bb7c05a36",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2022-42252 is NOT present in Apache Tomcat 10.1.18. The vulnerability involves accepting malformed Content-Length headers (containing control characters or invalid syntax) when rejectIllegalHeader is false, enabling request smuggling attacks. The fix was already included in upstream Apache Tomcat 10.1.18 (commit c9fe754e5d by Mark Thomas, October 2022) before TuxCare onboarded this version. The fix enforces that malformed Content-Length headers are ALWAYS rejected with HTTP 400, regardless of the rejectIllegalHeader configuration setting. Analysis confirmed the fix code is present, properly integrated into the HTTP header parsing path (Http11InputBuffer.java lines 1031-1048), and actively enforced during request processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:26a493ac-e85b-5361-9520-072c8e446511",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2023-24998 (Apache Commons FileUpload DoS via unlimited multipart parts) is NOT present in Tomcat 10.1.18. The fix was already included in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded. The fileCountMax defense mechanism exists in FileUploadBase.java with proper integration in Request.java, and is enabled by default with safe limits (maxParameterCount=1000, maxPartCount=10). The vulnerable pattern (unbounded multipart processing) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9291a352-e9de-5518-9d82-5584acf143d5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. Target Tomcat 10.1.18 is not affected by CVE-2023-28709. The vulnerability was an off-by-one error in parameter counting logic that allowed processing exactly one parameter beyond the configured maxParameterCount limit. The upstream fix (commit ba848da71c) was already present in the Tomcat 10.1.18 release that TuxCare onboarded. The fixed code checks parameterCount >= limit BEFORE incrementing, preventing the bypass. Author: markt@apache.org (Apache Tomcat upstream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7305a760-7846-5206-896b-f990e207d9e8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 10.1.18 is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced by bug 66512's fix, which caused AJP to skip sending SEND_HEADERS messages for responses with no HTTP headers, leading to header reuse from previous requests. The fix (bug 66591) was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded, authored by Apache's Mark Thomas (markt@apache.org). The current code uses a while loop that ensures SEND_HEADERS is always sent, even for empty header sets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:dbd2e008-65ed-55fd-a32a-51932f18441a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 does not affect Tomcat 10.1.18. Apache lists it only for 8.5.85-8.5.93 and 9.0.70-9.0.80, fixed in 8.5.94 and 9.0.81 by commits c99ffc30 and 43b882b8, which restore DiskFileItem.finalize(). In those versions getInputStream() opens the upload's temp file with FileInputStream, which on Windows blocks deleting the file while the application leaves the stream open, so the file is never deleted. In 10.1.18, getInputStream() uses Files.newInputStream, which opens the file with delete sharing, so the delete at the end of the request succeeds and the file is gone once the leaked stream is closed or garbage-collected. finalize() is not needed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a89fd787-f639-542f-956c-ab1ff9771ecb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Apache Tomcat 10.1.18. The vulnerability was fixed by upstream Apache developer Mark Thomas (commit 76bb4bfbfea, dated 2023-10-05) and shipped in the Tomcat 10.1.18 release BEFORE TuxCare onboarded it (2025-12-25). All three fix components are present and active by default: (1) overheadResetFactor configuration (default 50), (2) RST_STREAM frame overhead tracking in Http2UpgradeHandler.reset(), and (3) overhead limit enforcement in Http2AsyncParser that stops parsing and closes connections when the limit is exceeded. The defense prevents rapid reset attacks by penalizing each RST frame and terminating abusive connections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9bd34fb7-c484-5698-954d-522ba18a2bea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-45648 (HTTP trailer header parsing vulnerability) is NOT present in Tomcat 10.1.18. The target version includes the upstream fix that was released in Tomcat 10.1.14. The fix adds strict validation to reject trailer headers with non-token characters in names and control characters (except tab) in values, preventing request smuggling attacks. This fix was authored by Mark Thomas (Apache ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:5091a8d1-0724-57d8-981b-27fdb05674e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. The target Tomcat 10.1.18 repository is not affected by CVE-2023-46589. The vulnerability (improper validation of HTTP trailer headers leading to request smuggling) was fixed in upstream Apache Tomcat commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas. This fix was already included in the upstream Tomcat 10.1.18 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:78cc286b-539a-575b-889d-23a175f9b835",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.18 is not affected by CVE-2024-21733. The vulnerability, which allows disclosure of sensitive information through error messages when I/O should not be allowed, was fixed in the upstream Tomcat project and the fix was already present in the Tomcat 10.1.18 release. The target repository contains the complete mitigation: ErrorReportValve.java checks ActionCode.IS_IO_ALLOWED bef...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:d1f0b796-f5a1-5237-bec1-8eeb5b849e82",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-24549 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:253f15d2-f597-587f-b3ed-1f85e1d73953",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:add4ece4-bcff-5026-baae-fefb6df38bee",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:25fe1e43-11a0-5beb-942f-07c9520ea8ef",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.18 is not affected by CVE-2024-52317. This version does not have the request/response object pooling and recycling feature that causes the vulnerability. Each HTTP/2 stream has dedicated Request and Response objects (declared as final fields) that are never recycled or reused across different streams. The vulnerability affects versions 10.1.27-10.1.30, where object pooling wa...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a2972008-7a8f-5e0e-bafe-4542a22553f9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31650 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:4310babc-f952-55aa-9d5f-fdd403e7b693",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:69635445-5105-59d3-9cd1-4368c3f4c67f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52434 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. Tomcat 10.1.18 is NOT affected by CVE-2025-52434. The vulnerable component (APR/Native connector, specifically AprEndpoint.java) was completely removed from Tomcat 10.1.x on August 18, 2021, more than 2 years before version 10.1.18 was released (January 5, 2024). The target version only includes NIO-based connectors (NioEndpoint, Nio2Endpoint) and does not contain any APR/Native connector code. The CVE explicitly states the vulnerability is \"when using the APR/Native connector\" which is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9ee88b77-2ad5-52f0-b0f5-b6117227ff2c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-53506 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:558c8976-a1ea-5357-b157-71a75424c621",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:6ecbb4a6-91ff-57b7-9773-c50ae172cce2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:2c6d065b-8c32-53a9-87fe-61b5151133e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24734 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:5883c7be-dadc-5f3d-bdf6-3c2774d5252b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24880 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7438a961-db6a-5ada-925e-14cee2694066",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.18 is NOT affected by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved when TLS 1.3 specific cipher configuration was added. The bug occurred because code used HashSet (which doesn't preserve order) instead of LinkedHashSet when merging TLS 1.3 ciphers with other ciphers. However, version 10.1.18 predates the TLS 1.3 specific cipher confi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7aecd2bd-7224-5076-a204-11cdf776c2af",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:5af80042-487f-53a8-9a4b-5357baaaac1e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9ad3169b-e87e-58a8-a93e-ace9e1d5bad9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65637 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.18-tuxcare.10"
    }
  ]
}