{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f6da646d-2d56-5cdd-aade-56f8c87d4080",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3",
      "version": "10.1.33-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8b155c99-7908-5483-b29a-db7ac3b4175e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, where AJP requests with Content-Length: 0 caused thread hangs. The target (Tomcat 10.1.33) contains the upstream fix from 2014 that properly handles Content-Length: 0 by setting endOfStream and returning without waiting for body data. The fix was authored by upstream Apache developer Mark Thomas and was already present in the Tomcat 10.1.33 ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:48678558-867d-5065-afec-e94e1c96398b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is NOT present in Apache Tomcat 10.1.33. The vulnerability affected Tomcat versions up to 9.0.0.M11, and the fix was applied upstream by Mark Thomas in November 2016 (commit 516bda676a). The target version 10.1.33 is significantly newer and already contains the fix in its upstream release. The fix validates HTTP request line characters using HttpParser.isNotRequestTarget() and HttpParser.isHttpProtocol() methods, rejecting control characters, non-ASCII bytes, and specific punctuation that could enable HTTP response injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8; >= 8.0.0RC1, < 8.0.39; >= 7.0.0, < 7.0.73; >= 6.0.0, < 6.0.48), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 8.0.0; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6; >= 8.0.0.RC1, <= 8.0.38; >= 7.0.0, <= 7.0.72; >= 6.0.0, <= 6.0.47; < 6.0.0), Snyk (>= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9c313975-bb0a-512c-bfe1-be5d0137428a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 does not affect this target. The vulnerability was fixed by Apache Tomcat in March 2017 (commit 9233d9d6a0, bug 60918) and affects only versions 8.5.0-8.5.12 and 9.0.0.M1-M18. The fix is present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. Code analysis confirms all fix components are present: SendfileState tracking variable, loop condition checking state instead of data reference, processSendfile() method returning SendfileState, and no premature clearing of sendfileData in prepareRequest().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5d0f170e-4f50-54f3-9b60-7384a359c9aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 is not present in Apache Tomcat 10.1.33. The vulnerability required two attack vectors: (1) streams with blocking I/O operations that never complete, exhausting server threads, and (2) excessive overhead frames (SETTINGS, PING, PRIORITY) consuming server resources. Both defenses were added by upstream Apache Tomcat in February 2019: stream-level read/write timeouts (default 20 seconds) that release threads when blocking I/O doesn't progress, and overhead frame counting that closes connections when control frames dominate over data frames. These fixes were already present in Apache Tomcat 10.1.33 when TuxCare onboarded it in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:892aea84-d0b1-540a-a4a3-2d74fe35c2ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 is NOT present in Apache Tomcat 10.1.33. The vulnerability (HTTP/1.1 processor leak during h2c direct connection upgrade causing OutOfMemoryError) was fixed in upstream Apache Tomcat commit c9167ae30f by Mark Thomas before the 10.1.33 release. The fix is present in the target codebase at AbstractProtocol.java:918-919, where the HTTP/1.1 processor is explicitly released via release(processor) before creating the HTTP/2 upgrade processor. This upstream fix shipped with the 10.1.33 release that TuxCare onboarded, so the vulnerable code pattern has never existed in this TuxCare branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bc684a21-7a8a-57f8-b564-85484c83384e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.33 is NOT AFFECTED by CVE-2020-13943. The vulnerability involved HTTP/2 header contamination when clients exceeded concurrent stream limits. The vulnerable code checked stream limits in headersStart() before header parsing, allowing partial header state to leak between requests. The fix moved this check to headersEnd() after parsing completes. The target contains the fixed co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:be51a6fa-8d26-5186-b9dd-48ed1f961b25",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. Target version 10.1.33 is NOT affected by CVE-2020-17527. The vulnerability involved shared mutable state in HTTP/2 header processing that could cause header values from one request to leak into subsequent requests. All three components of the fix were already present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded: (1) HpackDecoder uses method-local StringBuilder instances instead of a shared instance variable, (2) ConnectionSettingsBase uses ConcurrentHashMap instead of EnumMap, and (3) AbstractProtocol properly handles leftover input during protocol upgrades. These fixes were authored by Mark Thomas (markt@apache.org) from Apache upstream in November 2020 and January 2021, well before the 10.1.33 release. The vulnerable code pattern never existed in the version maintained by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5a0234a5-e4a7-5af2-a511-696f862560bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 is NOT present in this Tomcat 10.1.33 target. The vulnerability involved incorrect timing of leftover input restoration during h2c connection upgrades, potentially causing request data from user A to leak to user B. The upstream fix (commit dd757c0a893 by Mark Thomas, 2021-01-14) was already included in Apache Tomcat 10.1.33 when TuxCare onboarded it. The current code correctly calls wrapper.unRead(leftOverInput) BEFORE creating the upgrade processor (line 913), preventing cross-request data leakage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0a7f0ce6-ea69-54d5-9088-8cc32949a9ef",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2022-42252 is not present in Apache Tomcat 10.1.33. The upstream fix for rejecting malformed Content-Length headers was already included in the Apache Tomcat 10.1.33 release that TuxCare onboarded. The defense code at Http11InputBuffer.java:1046-1049 forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader configuration, preventing the request smuggling vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:67debe51-a79a-51b8-81a9-01458c8ef56b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2023-24998 (Apache Commons FileUpload DoS via unbounded request parts) is NOT a vulnerability in this target. The fix was already present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The fileCountMax limit enforcement is fully implemented in FileUploadBase.java (lines 118, 206-217, 315-318) and properly configured in Request.java (line 2599). The fixing commit (8a2285f13af) was authored by upstream Apache developer markt@apache.org on 2023-01-03 and shipped in the 10.1.33 release before TuxCare's onboarding commit (47a79a9e4c). The vulnerable pattern (unbounded accumulation of multipart request parts) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fd32fd04-5db2-558a-a779-b55e9ab4ebbe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2023-28709 is NOT present in Apache Tomcat 10.1.33. The vulnerability was an off-by-one error in Parameters.addParameter() that allowed bypassing maxParameterCount when exactly that many query parameters were supplied. The fix (using `>=` instead of `>` and checking before incrementing) was included in the upstream Apache Tomcat 10.1.33 release by Mark Thomas (markt@apache.org) on 2023-04-11, well before the 10.1.33 release tag. The target repository's HEAD contains the fixed code at java/org/apache/tomcat/util/http/Parameters.java:204-210.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:37aa9397-3d46-53e7-b182-86b0f5561a2d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2023-34981 describes a regression in Apache Tomcat's AJP connector where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from the previous request (information leak). The target version 10.1.33 is NOT affected because the upstream fix (bug 66591) was already included in the 10.1.33 release. The code at AjpProcessor.java:962-1004 uses the fixed pattern (boolean needAjpMessageHeader with while loop) ensuring SEND_HEADERS is always sent even when numHeaders == 0. The vulnerable pattern (SEND_HEADERS only sent when i==0 inside the for loop) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:be4f3cfa-7128-5a0d-bc46-ae0812679aa2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 does not affect Tomcat 10.1.33. Apache lists it only for 8.5.85-8.5.93 and 9.0.70-9.0.80, fixed in 8.5.94 and 9.0.81 by commits c99ffc30 and 43b882b8, which restore DiskFileItem.finalize(). In those versions getInputStream() opens the upload's temp file with FileInputStream, which on Windows blocks deleting the file while the application leaves the stream open, so the file is never deleted. In 10.1.33, getInputStream() uses Files.newInputStream, which opens the file with delete sharing, so the delete at the end of the request succeeds and the file is gone once the leaked stream is closed or garbage-collected. finalize() is not needed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c2e1b620-024a-514c-b508-124ed4984a93",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is not present in Tomcat 10.1.33. The fix was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. Apache commit 76bb4bfbfea (2023-10-05) by Mark Thomas introduced comprehensive HTTP/2 overhead protection including: (1) overheadResetFactor=50 for weighted tracking of RST_STREAM frames, (2) overhead tracking in reset() method, (3) overhead tracking for priorityUpdate() frames, and (4) isOverheadLimitExceeded() check in Http2AsyncParser to stop parsing when limits exceeded. All defense components are present and active by default in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8ac09494-ab6e-5924-99b1-c4abaa95ca38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.33. The vulnerability required improper parsing of HTTP trailer headers that could lead to request smuggling. The upstream Apache Tomcat project fixed this in October 2023 and subsequently refactored the code in April 2024 to use a centralized HttpHeaderParser class. Version 10.1.33, released November 2024, shipped with the fix already present. The r...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:015c60d7-51db-5c13-8ed7-10f8be94d8ed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. Target version 10.1.33 is not affected by CVE-2023-46589. The upstream Apache Tomcat 10.1.33 release already included a refactoring that consolidated HTTP header and trailer parsing into a common HttpHeaderParser class (commits a5a7c11250 and 92e3c7a7ad by Mark Thomas, April 2024). This parser includes the exact character validation logic that CVE-2023-46589 patches added to earlier Tomcat versions: header names must be valid HTTP tokens, and header values must not contain control characters except tab. The vulnerable pattern (missing trailer header validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a07b8c70-c3ff-5ad5-b738-92aa6939d568",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Tomcat 10.1.33 is not affected by CVE-2024-21733. The vulnerability, which affects Tomcat 8.5.7-8.5.63 and 9.0.0-M11 through 9.0.43, concerns information disclosure through error messages when I/O operations are attempted on closed/invalid connections. The upstream fixes (commits ce4f9a5e0e and 86ccc43940 by Mark Thomas, Feb 2021) were already included in Tomcat 10.1.33 before TuxCare onboarded...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fb6e3b0e-0879-5003-996a-c86b8bd87a3a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. Target version 10.1.33 is not affected. The upstream Apache Tomcat fix for CVE-2024-24549 is already present in this version. The fix moves HTTP/2 header validation from after all frames are processed to after each individual HEADERS/CONTINUATION frame, preventing attackers from forcing the server to buffer excessive header data before limits are checked. The fix was authored by upstream (Mark Thomas, markt@apache.org) on Jan 25, 2024 and was included in Apache Tomcat 10.1.19+. TuxCare onboarded upstream 10.1.33 which already contained this fix.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:93acbae1-529f-50f1-be53-ab02a284ca10",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-34750 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. CVE-2024-34750 is NOT present in the target. The vulnerability involves incorrect HTTP/2 stream counting leading to connections remaining open indefinitely. The upstream fix (commit 2afae300c9 by Mark Thomas) was already included in Apache Tomcat 10.1.25, and is present in the target's base version 10.1.33. The fix adds atomic compare-and-set logic to ensure each stream is counted exactly once and removed from the active count exactly once, preventing the miscounting that leads to incorrect timeout application. TuxCare onboarded upstream 10.1.33 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c726d202-f2d0-5fca-8074-5fb58d1032cf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38286 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.33 is NOT AFFECTED by CVE-2024-38286. The vulnerability allows attackers to cause OutOfMemoryError by abusing TLS handshake re-keying to accumulate unbounded handshake wrap requests. However, version 10.1.33 already contains the upstream Apache fix (commit 3344c17cef by Mark Thomas, first released in 10.1.25 on 2024-06-14). The fix adds: (1) In SecureNio2Channel: handshakeWrapQueueLength counter with HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT=100; (2) In SecureNioChannel: needHandshakeWrap boolean flag. Both prevent unbounded accumulation by terminating connections when limits are exceeded. The fix was shipped in the upstream 10.1.33 release and onboarded by TuxCare on 2026-10-07. CVE affected versions 10.1.0-M1 through 10.1.24; fixed in 10.1.25+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:28a82c36-5537-53a5-910c-b1bc545a6136",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-52317 affects Apache Tomcat versions 10.1.27-10.1.30, with the fix released in version 10.1.31. The target repository is version 10.1.33, which already contains the upstream vendor's fix. The double-checked locking mechanism to prevent duplicate request/response recycling is present in both Stream.java (lines 111-112, 837-855) and StreamProcessor.java (line 149). This fix was shipped i...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bd240ae9-21b0-54fe-90f6-818dafc9f247",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31650 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2b0d1ceb-c0ee-528a-8b3f-7852be033798",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:07baa478-4e1e-5439-b540-da538600492f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52434 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. Tomcat 10.1.33 is not affected by CVE-2025-52434 because the vulnerable APR/Native connector (AprEndpoint.java) was removed from the Tomcat 10.1.x line by Apache upstream before the 10.1.0 release. The removal occurred in commit 314568fa450680711f12f01ee050f2166f4263bd (August 2021, author: Mark Thomas <markt@apache.org>), which is an ancestor of the onboarding commit for version 10.1.33. The CVE explicitly affects \"the APR/Native connector\" which is completely absent from this target version. Only NioEndpoint and Nio2Endpoint implementations exist, which use pure Java NIO APIs rather than native JNI socket calls, and therefore do not exhibit the same race condition vulnerability pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:766aafaf-ba3d-54fc-8b63-79e808c47a18",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-53506 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0be30abd-abe6-5aa3-a1cd-895171851da3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4959e524-abde-5985-b52f-146a36137e3c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:10a3a893-0218-5efe-bf71-5c2ff7af4536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24734 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:cd7ad949-9f81-5c81-90e5-169109fd4e29",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24880 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e41478ca-1e25-5d15-b25f-db10859ff119",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.33 is NOT affected by CVE-2026-29129. The vulnerability was introduced in a later version (between 10.1.33 and 10.1.51) when TLS 1.3 cipher suite support was added in January 2026. The target version uses a simpler code path that already preserves cipher order via LinkedHashSet, and lacks the HashSet-based cipher merging logic that caused the order preservation bug in version...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4498c279-79af-536a-83fb-8ddb7d2d5b4b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 10.1.33 is NOT AFFECTED by CVE-2026-32990. The vulnerable code pattern (the checkSni method with improper protocol hostname normalization) does not exist in this version. The vulnerability was introduced in later versions (10.1.50-10.1.52) when the strict SNI validation feature was added via CVE-2025-66614's fix, and the incomplete normalization in that new code created CVE-2026-...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:90cf37e2-8fd0-5dba-986c-4e4d7fa3f92b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5e32801d-3a28-56aa-beb4-606431eacefd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65637 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33-tuxcare.3"
    }
  ]
}