{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b16a7b6d-ac2c-565c-b12a-2e7d3d78bec4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1",
      "version": "10.1.50-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:31cd06fb-f4a9-5194-8832-c4e9ccc02ed8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 is NOT present in Apache Tomcat 10.1.50. The vulnerability caused AJP processors to hang when receiving Content-Length: 0 requests. The target contains an explicit defense at AjpProcessor.java:613-616 that checks for contentLength == 0 and skips body reading (sets endOfStream=true, returns false), preventing the hang. This fix was authored by upstream Apache Tomcat developer Mark ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:565747a1-f1ad-56e1-a47d-97b294cf3db9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is not present in the target Tomcat 10.1.50 repository. The vulnerability involves HTTP request line parsing accepting invalid characters, which could enable response injection attacks. The upstream Apache Tomcat project fixed this in commit 516bda676a (authored by Mark Thomas) by adding strict character validation to three points: method name parsing (reject non-token chars), request target parsing (reject control chars, non-ASCII, and unsafe chars like space, quotes, angle brackets, backslash, caret, backtick, braces, pipe), and protocol string parsing (restrict to valid HTTP protocol chars only). This fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8; >= 8.0.0RC1, < 8.0.39; >= 7.0.0, < 7.0.73; >= 6.0.0, < 6.0.48), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 8.0.0; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6; >= 8.0.0.RC1, <= 8.0.38; >= 7.0.0, <= 7.0.72; >= 6.0.0, <= 6.0.47; < 6.0.0), Snyk (>= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:50c54879-bb59-5272-9233-9fd87f63096f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 10.1.50 is not affected by CVE-2017-5651. The vulnerability was a sendfile processing race condition that could cause a Processor to be added to the cache twice, leading to request/response mix-up. The fix (commit 9233d9d6a0 by Mark Thomas) was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The fix introduces SendfileState tracking to capture the sendfile processing state before cleanup, preventing the race condition. All fix elements are verified present in the target code: SendfileState local variable (line 265), while loop condition (line 268), processSendfile() method (line 1420), and corrected return logic (line 476).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3bb4c41e-9651-5599-b617-d347ea33ff80",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. The target is Apache Tomcat 10.1.50, which already includes all upstream fixes for this vulnerability. The fixes were authored by Mark Thomas (markt@apache.org) in early 2019 and shipped with the upstream Tomcat 10.1.50 release that TuxCare onboarded. The three key defenses are present: (1) stream read timeout preventing indefinite blocking on request body reads, (2) stream write timeout preventing indefinite blocking when flow control window is exhausted, and (3) overhead frame tracking that closes connections sending excessive SETTINGS/PRIORITY/PING frames. All fixes were present before the first TuxCare commit (8f04542b9a \"Onboard version 10.1.50\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8959e798-cab8-5ec5-a9b8-3ef1d4218d25",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934: The target Apache Tomcat 10.1.50 is NOT AFFECTED. The vulnerability (HTTP/1.1 processor leak during h2c direct connections leading to OutOfMemoryException) has been fixed by upstream commit c9167ae30f. This fix was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix adds a `release(processor)` call at line 917 of AbstractProtocol.java before creating the HTTP/2 upgrade processor, preventing processor object accumulation. Since the fix was authored by markt@apache.org (not TuxCare/CloudLinux) and was part of the upstream release, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6d6ba065-8699-5177-9e21-f686775e32e5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Version 10.1.50 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f268-65qc-98vg (affected below 10.0.0-M8), NVD (affected up to 10.0.0-milestone7), CVE record (affected up to 10.0.0-M7), Snyk (affected below 10.0.0-M8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:02cab0e5-1309-549d-98e5-386b54923c09",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527 is NOT present in Apache Tomcat 10.1.50-tuxcare.2. The vulnerability involved HTTP/2 header value re-use between requests due to a shared mutable StringBuilder instance field in HpackDecoder.java. The fix (converting StringBuilder to local variables) was applied by Apache upstream in commit 8d2fe6894d on November 9, 2020, and was included in the upstream 10.1.50 release before TuxCare onboarded it on September 20, 2026. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:47e5a679-4c5b-50a2-8123-7ceb4ca42fdc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 is NOT present in Apache Tomcat 10.1.50. All three upstream fixes for BZ 64830 are already applied: (1) HpackDecoder uses method-local StringBuilder instead of shared instance field, preventing concurrent request contamination; (2) AbstractProtocol restores leftover input to wrapper before creating h2c processor; (3) HTTP/1.1 processor is properly released during h2c upgrade. All fixes were authored by upstream Apache (markt@apache.org) and shipped in upstream release 10.1.50, which TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6f2088e7-a115-5bfd-80bc-03177149e486",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2022-42252 is not present in Apache Tomcat 10.1.50. The vulnerability (request smuggling via invalid Content-Length headers when rejectIllegalHeader=false) was fixed in the upstream Apache Tomcat 10.1.50 release. The fix at Http11InputBuffer.java:1034-1037 ensures malformed Content-Length headers are always rejected regardless of rejectIllegalHeader configuration, by checking the header name and forcing rejection. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:652eb192-d4c4-59bb-a377-14946a96d737",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2023-24998 fix is present and active in Apache Tomcat 10.1.50. The vulnerability concerns unbounded processing of multipart/form-data request parts leading to DoS. The upstream fix adds a fileCountMax limit with default enforcement via maxParameterCount (10,000 parts). This fix was included in the upstream Apache Tomcat 10.1.50 release (committed Dec 13, 2022 by markt@apache.org) before TuxCare onboarded the version on Sep 20, 2026 (commit 8f04542b9a). No separate TuxCare backport was needed for 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8e8bebfc-e6d1-5f95-b54f-9b91953eaed5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2023-28709 (parameter counting bypass) is NOT present in target Apache Tomcat 10.1.50. The fix (commit ba848da71c by Mark Thomas) was already included in the upstream 10.1.50 release that TuxCare onboarded. The vulnerable pattern (incrementing parameterCount before checking the limit, using > instead of >=) does not exist in the target code. The current code correctly checks if parameterCount >= limit BEFORE incrementing, preventing the off-by-one error that allowed bypassing maxParameterCount when exactly that many parameters were supplied in the query string.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a4cd5ad4-21fd-5dff-9ec8-6c1395ac9d0c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2023-34981 is not present in Apache Tomcat 10.1.50. The vulnerability (a regression in the bug 66512 fix that prevented AJP SEND_HEADERS messages from being sent for responses with no headers, causing mod_proxy_ajp to reuse headers from previous requests) was fixed by upstream Apache in commit f0742f47b9 (bug 66591) on May 3, 2023, before the 10.1.50 release. TuxCare onboarded version 10.1.50 with the fix already included. The target code implements the defense via a while loop that ensures SEND_HEADERS is sent unconditionally, even when the response has zero headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa871f12-015a-5f15-b7d1-7a7184f01b0c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 does not affect Tomcat 10.1.50. Apache lists it only for 8.5.85-8.5.93 and 9.0.70-9.0.80, fixed in 8.5.94 and 9.0.81 by commits c99ffc30 and 43b882b8, which restore DiskFileItem.finalize(). In those versions getInputStream() opens the upload's temp file with FileInputStream, which on Windows blocks deleting the file while the application leaves the stream open, so the file is never deleted. In 10.1.50, getInputStream() uses Files.newInputStream, which opens the file with delete sharing, so the delete at the end of the request succeeds and the file is gone once the leaked stream is closed or garbage-collected. finalize() is not needed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bc75635b-7ee4-561d-8b6b-484a0805a9cc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in the target. The upstream Apache Tomcat fix (commit 76bb4bfbfe by Mark Thomas, Oct 5 2023) was already included in version 10.1.50 when TuxCare onboarded it. The defense tracks RST_STREAM frames with a 50x overhead penalty (overheadResetFactor=50), PRIORITY_UPDATE frames, and stops processing when the overhead limit is exceeded. All protections are enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c263bd9c-94f7-5c79-b0b2-9d50f57efdb0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 10.1.50 is NOT AFFECTED by CVE-2023-45648. The upstream Apache Tomcat 10.1.50 release already contained the fix for improper HTTP trailer header validation. The vulnerability (unvalidated trailer headers enabling request smuggling) is not present because the code includes HttpHeaderParser with proper validation that rejects non-token characters in header names and control charact...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:67ace922-6fb4-5b3f-ace9-3f95b730a622",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.50 is not vulnerable to CVE-2023-46589. The target version is after the fixed version 10.1.16. The vulnerability (improper HTTP trailer header validation leading to request smuggling) is not present because the target uses a refactored HttpHeaderParser class introduced by upstream Apache in April 2024 that includes the required validation. The fix was part of the upstream 10.1.50 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4976ba82-9bfa-5cc3-9e05-6006c87722b4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-21733 is not present in Tomcat 10.1.50. The vulnerability affects versions 8.5.7-8.5.63 and 9.0.0-M11-9.0.43, and was fixed in 8.5.64+ and 9.0.44+. The target version 10.1.50 is significantly newer and already contains the upstream fix (commit ce4f9a5e by Mark Thomas, Feb 2021) that prevents information disclosure by checking if I/O is allowed before attempting to write error reports. ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c3b1ebec-7926-5ac1-94cf-ed98935ccd87",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.50 is not affected by CVE-2024-24549. The vulnerability affects versions up to 10.1.18, and was fixed by Apache in version 10.1.19. The target version 10.1.50 was onboarded with the upstream vendor fix already present. The fix moves HTTP/2 header validation from the end of header processing to the end of each frame (HEADERS and CONTINUATION), preventing resource exhaustion from processing excessive headers.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4977e34a-62a7-5072-97b8-d46227448e46",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-34750 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. The target repository (Apache Tomcat 10.1.50) is NOT affected by CVE-2024-34750. The vulnerability involves incorrect active HTTP/2 stream counting that could lead to connections remaining open indefinitely. The upstream fix (commit 2afae300c9 by Mark Thomas) shipped in Apache Tomcat 10.1.25 and is present in this 10.1.50 version. The fix adds idempotency protection using AtomicBoolean compare-and-set to ensure each stream is removed from the active count exactly once, preventing miscounting. All fix components are present and properly integrated in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:63e7e8c6-fad5-5bfb-af15-854369b7fd86",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38286 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2024-38286. The fix for this TLS handshake resource exhaustion vulnerability was already present in the upstream Apache Tomcat 10.1.50 release. The defense mechanisms (HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT counter in SecureNio2Channel and needHandshakeWrap flag in SecureNioChannel) were introduced by upstream commit 3344c17cef094da4bb616f4186ed32039627b543 authored by Mark Thomas (markt@apache.org), which shipped with the release before TuxCare onboarded it. No TuxCare backport for this CVE to version 10.1.50 exists because the fix was already present in the upstream code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ad9a9f98-afb6-505d-8fda-c5aed7e043eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-52317 is NOT present in Apache Tomcat 10.1.50. The vulnerability (incorrect recycling of HTTP/2 request/response objects leading to data mix-up between users) was fixed in upstream version 10.1.31. The target version 10.1.50 includes the complete upstream fix: Stream.recycle() is split into replace() and recycle(), with double-checked locking preventing duplicate recycling. This fix wa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:562e3a29-1bf2-5185-9f7a-0476f92ee053",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31650 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2025-31650 affects Apache Tomcat versions 10.1.10 through 10.1.39. The target version 10.1.50 is not affected because all three security fixes for this CVE were already included in the upstream Apache Tomcat 10.1.40 release (April 2025), which predates 10.1.50 (December 2025). The fixes were authored by Mark Thomas (markt@apache.org), an upstream Apache committer, and shipped in the official 10.1.50 release before TuxCare onboarded the version in September 2026. No TuxCare backport was necessary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41987df7-272b-53d7-b21e-6e9ed3551127",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48989 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2025-48989 (made you reset attack) is NOT present in Tomcat 10.1.50-tuxcare.2. The upstream fix was already included in Tomcat 10.1.50 when TuxCare onboarded it. The vulnerability allowed attackers to exhaust server resources by triggering server-initiated RST_STREAM frames that were not properly tracked in the HTTP/2 overhead protection system. The fix adds overhead counting when the server SENDS reset frames (not just when receiving them), preventing resource exhaustion. Fix commit 73c04a10395774bda71a0b37802cf983662ce255 by Mark Thomas was shipped in the upstream Tomcat 10.1.50 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108; >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108), NVD (>= 9.0.1, < 9.0.108; >= 10.0.0, < 10.1.44; >= 11.0.0, < 11.0.10; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.9; >= 10.1.0-M1, <= 10.1.43; >= 9.0.0.M1, <= 9.0.107), Snyk (>= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10; >= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:146bfe90-0ff5-56a0-84ee-c11378513f71",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52434 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2025-52434 affects the APR/Native connector (AprEndpoint.java) which was removed from Apache Tomcat 10.x in August 2021 (commit 314568fa45). Version 10.1.50 uses only NIO and NIO2 connectors, which have fundamentally different architectures (standard Java sockets vs APR native JNI calls) and do not exhibit the JVM crash risk that the CVE addresses. The vulnerable component has never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7cb11af0-d631-5d15-939b-0987c3c75561",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-53506 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2025-53506 is NOT present in this target. The vulnerability fix was already included in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix (commit 2aa6261276 by markt@apache.org) enforces HTTP/2 connection limits (MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE) immediately upon connection initialization, without waiting for client ACK of the SETTINGS frame. This prevents malicious clients from bypassing stream limits by refusing to acknowledge settings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9), NVD (>= 9.0.0, <= 9.0.106; >= 10.1.0, <= 10.1.42; >= 11.0.0, <= 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7fa5a719-8e8f-5041-a3a1-edb5c72b6eeb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-66614 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target version 10.1.50 is NOT AFFECTED by CVE-2025-66614. The vulnerability (missing SNI-to-Host header validation that allowed client certificate authentication bypass) was fixed by Apache upstream in commit 972f9a5e2a, which shipped as part of the Apache Tomcat 10.1.50 release. The fix is present in the target at the analyzed SHA (00fc3ab247). The CVE documentation correctly identifies 10.1.50 as the first fixed version in the 10.1.x branch. TuxCare onboarded the already-fixed upstream release without needing a separate backport for this CVE on the 10.1.50 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d6bd8b19-7304-5b3e-96de-7128d55a5613",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-24733 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.50 is NOT affected by CVE-2026-24733. The vulnerability (accepting non-GET HTTP methods for HTTP/0.9 requests) is not present in the target. The upstream fix authored by remm@apache.org (commit 711b465cf2) was already included in the Apache Tomcat 10.1.50 release that TuxCare onboarded. The defense validates that HTTP/0.9 requests use only the GET method and rejects all other...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:509eb747-383c-5a71-a29d-71d8c16c842f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24734 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3fc291c1-33f9-5c01-8e28-c293046691f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24880 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 10.1.50-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e464d7a6-f9a4-5d53-85a0-f8e165ef84b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 10.1.50 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added with a code defect (using HashSet instead of LinkedHashSet), causing configured cipher preference order to be lost. Version 10.1.50 predates this feature and uses a simpler, correct implementation that properly preserves cipher order via Linke...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b7fe2855-bf1e-5dca-83d6-6e2382698a51",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a6fc0354-1ffd-5747-99b4-281fde6796ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 10.1.50-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a481a3ba-2e7a-5697-91f5-7d2efd3113fe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65637 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.50-tuxcare.1"
    }
  ]
}