{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:beee3758-ec40-51a3-8095-ce3f161d618b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2",
      "version": "10.1.55-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bfe709dc-902d-5e28-a772-eb78a73e3942",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing thread consumption via Content-Length: 0 AJP requests. The upstream fix (commit 8884dae60ac by Mark Thomas, 2014-03-17) added explicit handling for zero-length requests by setting endOfStream=true and returning early, preventing the thread hang. This fix was already present in Tomcat 10.1.55 when TuxCare onboarded it (commit df13cfd2...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b755a96c-b969-5dd2-b7eb-78c34b167579",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target version (Apache Tomcat 10.1.55) is NOT vulnerable to CVE-2016-6816. The vulnerability affected Tomcat versions up to 9.0.0.M11, 8.5.6, 8.0.38, 7.0.72, and 6.0.47. The fix for CVE-2016-6816 was applied by Apache upstream in November 2016 (commit 516bda676a by Mark Thomas). Version 10.1.55 was released by Apache in 2024, many years after the fix, and the protective validation code is present in the upstream release. The target contains HttpParser.isNotRequestTarget(), HttpParser.isHttpProtocol(), and HttpParser.isToken() validation methods that reject invalid characters in HTTP request lines, preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8; >= 8.0.0RC1, < 8.0.39; >= 7.0.0, < 7.0.73; >= 6.0.0, < 6.0.48), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 8.0.0; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6; >= 8.0.0.RC1, <= 8.0.38; >= 7.0.0, <= 7.0.72; >= 6.0.0, <= 6.0.47; < 6.0.0), Snyk (>= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:151f9b61-f8d7-5c00-acef-12d4467dd4ea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 is NOT present in Apache Tomcat 10.1.55. The vulnerability (sendfile state tracking race condition causing processor double-caching and response mix-up) was fixed in the upstream release. Fix commit 9233d9d6a0 by markt@apache.org is present in HEAD and predates TuxCare's onboarding commit df13cfd2cc. All defense mechanisms from the vendor patch are verified in the target code: SendfileState variable tracks completion independently of sendfileData pointer, preventing incorrect SocketState return when sendfile completes quickly and processor is recycled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:90df5bbf-0e03-5e11-b186-42faa1e78f36",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199: Target Tomcat 10.1.55 is NOT AFFECTED. The vulnerability involves HTTP/2 DoS via excessive control frames and indefinite thread blocking when clients keep streams open without reading/writing data. The upstream Tomcat 10.1.55 release includes comprehensive fixes: (1) stream-level read/write timeouts (20s defaults) that unblock threads waiting for client data or flow control window increases, and (2) overhead frame counting that tracks control frames (SETTINGS, PING, PRIORITY, RST) vs data frames and closes connections with ENHANCE_YOUR_CALM when overhead exceeds threshold. These defenses were added by Apache committer Mark Thomas in commit c38033338a (\"Add stream timeouts\") and related overhead protection commits, all shipped in the upstream release before TuxCare onboarded version 10.1.55. The vulnerable pattern (indefinite thread blocking leading to exhaustion) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c2b119f6-b01b-5b4d-a5c7-3515fbf827ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 is NOT present in target Tomcat 10.1.55. The fix (commit c9167ae30f by Mark Thomas) was already included in the upstream Tomcat 10.1.55 release that TuxCare onboarded. The vulnerable pattern\u2014failing to release the HTTP/1.1 processor during h2c direct upgrade\u2014does not exist in HEAD. Both fix elements are present: release(processor) call at line 1286 and proper state handling at line 1295 of AbstractProtocol.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a2ce9641-7eca-5f4b-9710-92f58dc174c4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2020-13943 is NOT present in Apache Tomcat 10.1.55. The vulnerability involved HTTP/2 header state contamination when clients exceeded the maximum concurrent stream limit. The vendor fix moved the concurrent-stream validation from headersStart() to headersEnd(), ensuring validation occurs AFTER headers are fully parsed. This fix was already present in the upstream Apache Tomcat 10.1.55 rele...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f3836921-919b-5d40-a2d7-55d351b6789f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527 is NOT present in Apache Tomcat 10.1.55. The vulnerability involved re-using HTTP request header values across HTTP/2 streams due to a shared StringBuilder instance in the HPACK decoder. The fix (commit 8d2fe6894d) was applied by Apache upstream in November 2020 and shipped with Tomcat 10.1.55, which TuxCare onboarded in September 2026. The vulnerable pattern (shared mutable StringBuilder) does not exist in the target; instead, local StringBuilder instances are created per decoding operation, preventing cross-request contamination.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8d6ff11b-9537-5619-ad43-f929d998b915",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 is not present in Apache Tomcat 10.1.55. The vulnerability involved a shared StringBuilder instance field in HpackDecoder that could be accessed concurrently by multiple h2c requests, causing request data from one user to leak into another user's request. The fix (commit 8d2fe6894d by Mark Thomas) replaced the shared instance field with request-local StringBuilder variables, eliminating the cross-request contamination. This fix was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it (first TuxCare commit: df13cfd2cc). The target repository contains the fixed code with no shared StringBuilder fields.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5eed7e5d-f794-5808-bcf1-a6d65841d754",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2022-42252 is not present in Apache Tomcat 10.1.55. The vulnerability affects versions 8.5.0-8.5.82, 9.0.0-M1-9.0.67, 10.0.0-M1-10.0.26, and 10.1.0-M1-10.1.0. The target version 10.1.55 is beyond this range and contains the upstream fix (commit c9fe754e5d) that forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting. The fix was authored by Mark Thomas (markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9db45b98-50b8-5545-814b-00aab65b7cab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2023-24998 (DoS via unbounded multipart request parts) is NOT present in Tomcat 10.1.55. The upstream Apache Tomcat fix was already included in the 10.1.55 release that TuxCare onboarded. The fix adds FileUploadBase.setFileCountMax() and checks items.size() == fileCountMax before processing each part, throwing FileCountLimitExceededException when the limit is exceeded. Request.parseParts() applies this limit by computing partLimit from maxParameterCount and maxPartCount. All fix components (FileUploadBase defense check, Request integration, Parameters.size() method, FileCountLimitExceededException class) are present in the target at the authoritative SHA c5b492c1bfe321aa1526c142774a77d53804c197.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:db8c3844-fff4-5ad2-8a33-3938ad140f5d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target Tomcat 10.1.55 is NOT AFFECTED by CVE-2023-28709. The vulnerability (an off-by-one error in parameter counting that could allow bypassing maxParameterCount limits) was fixed in upstream Tomcat 10.1.8 by commit ba848da71c on April 11, 2023. The fix was already present in the upstream 10.1.55 release when TuxCare onboarded it (commit df13cfd2cc). The target's Parameters.java::addParameter() method (lines 198-213) shows the corrected logic: the limit check happens BEFORE incrementing the counter (line 204) using >= comparison, and the increment happens AFTER the check (line 210), preventing the boundary condition bypass described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dd05e343-deac-5dea-a67a-995104217d95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2023-34981 affects Apache Tomcat versions 11.0.0-M5, 10.1.8, 9.0.74, and 8.5.88 due to a regression in the fix for bug 66512. The target version 10.1.55 is NOT affected. The vulnerability was fixed in the upstream Apache Tomcat release by commit f0742f47b9 (authored by markt@apache.org on 2023-05-03), which was already present when TuxCare onboarded version 10.1.55. The fix ensures that an AJP SEND_HEADERS message is always sent for every response, even when the response contains no HTTP headers, preventing mod_proxy_ajp from reusing headers from previous requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:693e1c32-b54a-5e93-995f-2efcc8b00bac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 does not affect Tomcat 10.1.55. Apache lists it only for 8.5.85-8.5.93 and 9.0.70-9.0.80, fixed in 8.5.94 and 9.0.81 by commits c99ffc30 and 43b882b8, which restore DiskFileItem.finalize(). In those versions getInputStream() opens the upload's temp file with FileInputStream, which on Windows blocks deleting the file while the application leaves the stream open, so the file is never deleted. In 10.1.55, getInputStream() uses Files.newInputStream, which opens the file with delete sharing, so the delete at the end of the request succeeds and the file is gone once the leaked stream is closed or garbage-collected. finalize() is not needed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a5c89aea-7fd8-5521-8214-e38515b64793",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix by Mark Thomas (markt@apache.org) in commit 76bb4bfbfeae827dce896f650655bbf6e251ed49 shipped with the Apache Tomcat 10.1.55 release that TuxCare onboarded. The defense is complete and enabled by default: RST frames increment an overhead counter by factor 50, and connections are closed when the threshold is exceeded. No TuxCare backport was required - the vulnerability pattern is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:02738fb2-2b0f-5382-9100-84f2ac8331ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:53436449-0614-5ab8-b661-77fd13e0bf55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 10.1.55 is not affected by CVE-2023-46589. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed upstream by Apache in October-November 2023 and shipped in Apache Tomcat 10.1.16+. The target version 10.1.55 was onboarded by TuxCare from the upstream release, which already contained the fix in refactored form: (1) HttpHeaderParser validates trailer header names using HttpParser.isToken() and values using HttpParser.isControl() checks, rejecting malformed headers; (2) InputBuffer.handleReadException() ensures IOExceptions during request reading set error flags to prevent request boundary confusion. Original CVE fix commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 (2023-10-05) by markt@apache.org was later refactored into HttpHeaderParser (a5a7c112505b471e943967fd33c72299cbe6bb9f, 2024-04-26), both predating the first TuxCare onboarding commit df13cfd2cca80866443a0ebeb3873a17370617a9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05d91385-dae4-5b09-b3cc-75567d47180b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target Tomcat 10.1.55 is NOT AFFECTED by CVE-2024-21733. The fix for this vulnerability (checking IS_IO_ALLOWED before error I/O operations to prevent sensitive information disclosure) was already present in upstream Apache Tomcat 10.1.55 when it was released (2026-05-05). The fixing commit ce4f9a5e by markt@apache.org from 2021-02-24 was included in the upstream release that TuxCare onboarded ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:36842bf5-6d57-5ad1-9ab9-7c11d6a5958c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:348d085e-30d9-5616-9c56-db8c247fd97e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-34750 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2024-34750 affects Apache Tomcat 10.1.0-M1 through 10.1.24 and is fixed in 10.1.25. The target is version 10.1.55, which already contains the upstream fix. The vulnerability involved miscounting of active HTTP/2 streams due to potential double-decrement operations during exceptional conditions, leading to incorrect infinite timeouts. The fix adds an atomic compareAndSet flag per stream to ensure idempotent decrement. This fix is present in the target at Stream.java:98,999-1010, introduced by upstream Apache commit 2afae300c9 (author: markt@apache.org) which shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:de981246-b0e2-5d6b-9448-f0ede57965b9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38286 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 10.1.55 is not affected by CVE-2024-38286. The vulnerability (unbounded accumulation of TLS handshake wrap requests leading to OutOfMemoryError) is not present because the upstream Apache Tomcat project already included the fix in version 10.1.55. Both TLS channel implementations (SecureNio2Channel and SecureNioChannel) contain complete defenses: SecureNio2Channel limits handshake wrap queue length to 100 via HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT constant with checks at lines 810-813, 1016-1020, and 1131-1135; SecureNioChannel uses needHandshakeWrap boolean flag with pending checks at lines 660 and 756. The fix commit (3344c17cef by Mark Thomas) was already in the upstream 10.1.55 release when TuxCare onboarded it via commit b0c0568037.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f5a4994c-ff62-5847-beea-f4d5f7f979bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is not affected by CVE-2024-52317. The vulnerability involves incorrect recycling of HTTP/2 request/response objects that could lead to request/response data mix-up between users. The fix, which adds double-checked locking to prevent duplicate recycling calls, was already present in the upstream Apache Tomcat 10.1.55 release when TuxCare onboarded i...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3545bfb9-c14c-52b1-be72-b071edc3df2a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31650 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.55 is NOT affected by CVE-2025-31650. The vulnerability affects versions 10.1.10 through 10.1.39, with fixes released in 10.1.40. Version 10.1.55 is newer and already contains all three upstream fixes from Apache (commits cba1a0fe12, 1eef1dc459, 8cc3b8fb3f) that were authored by Mark Thomas (markt@apache.org) and shipped in the upstream release before TuxCare onboarded this version in September 2026. The vulnerable code pattern (missing exception handling for invalid HTTP/2 priority headers) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f2176e58-031c-51d8-af46-b3593bfa180b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48989 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 10.1.55 is not affected by CVE-2025-48989 (the \"made you reset\" attack). The upstream fix commit 73c04a10395774bda71a0b37802cf983662ce255 by Mark Thomas was already included in the Apache Tomcat 10.1.55 release before TuxCare onboarded it. The fix adds overhead accounting for server-sent RST frames, preventing resource exhaustion by incrementing the overhead counter when the server sends RST_STREAM frames.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108; >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108), NVD (>= 9.0.1, < 9.0.108; >= 10.0.0, < 10.1.44; >= 11.0.0, < 11.0.10; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.9; >= 10.1.0-M1, <= 10.1.43; >= 9.0.0.M1, <= 9.0.107), Snyk (>= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10; >= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1c291ab6-d31b-5a40-b694-75a3bce837d8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52434 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Tomcat 10.1.55 is not affected by CVE-2025-52434. The vulnerability is specific to the APR/Native connector (AprEndpoint class), which was architecturally removed from Tomcat in version 10.1.0-M5 (September 2021), before version 10.1.55 was released. The CVE explicitly states it affects Tomcat 9.0.0.M1 through 9.0.106 and EOL 8.5.x versions, with no mention of Tomcat 10.x. The target repository contains only NioEndpoint and Nio2Endpoint implementations, which use different connection handling mechanisms. This is a Type A2 case where the vulnerable component (APR connector) does not exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38cd0839-3bb8-5c08-b44c-175e9acef1ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-53506 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2025-53506. The upstream fix (commit 2aa6261276ebe50b99276953591e3a2be7898bdb by Mark Thomas) that addresses the HTTP/2 resource exhaustion vulnerability was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix applies MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE limits immediately at connection initialization (force=true), preventing malicious clients from exhausting server resources by ignoring the initial SETTINGS frame acknowledgment. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9), NVD (>= 9.0.0, <= 9.0.106; >= 10.1.0, <= 10.1.42; >= 11.0.0, <= 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e148418b-3a4c-5905-999b-866b4054b786",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-66614 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target repository (Apache Tomcat 10.1.55) is NOT affected by CVE-2025-66614. The vulnerability, which allowed client certificate authentication bypass via mismatched SNI and HTTP Host headers, was fixed in upstream Apache Tomcat version 10.1.50. Since the target is version 10.1.55, the fix was already present in the upstream release that TuxCare onboarded. The fix commit (972f9a5e2a) authored by remm@apache.org is an ancestor of HEAD and predates all TuxCare commits in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:354ddc5c-b1c1-5370-bf12-663bcb1a0943",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-24733 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2026-24733. The CVE describes a vulnerability where HTTP/0.9 requests were not limited to the GET method, allowing security constraint bypass. However, the fix was already present in upstream Apache Tomcat 10.1.55 (released after the fixed version 10.1.50). The defense code is present at Http11Processor.java:612-616, which rejects HTTP/0.9 requests w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5fdad5d6-1537-5cfb-a42d-2b4a103edf9b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-24734 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.55 is NOT affected by CVE-2026-24734. The vulnerability affects Tomcat versions 10.1.0-M7 through 10.1.51, with the fix introduced in 10.1.52. The target version 10.1.55 already contains the upstream fix (commit e3b562d4cd) that was shipped as part of the Apache Tomcat 10.1.55 release. All required OCSP verification and freshness checks are present in the OpenSSL/Panama FFM implementation, including nonce verification, signature verification, and validity timestamp checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115; >= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115), NVD (>= 9.0.83, < 9.0.115; >= 10.1.1, < 10.1.52; >= 11.0.1, < 11.0.18; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9; >= 1.3.0, < 1.3.5; >= 2.0.0, < 2.0.12), cve.org (>= 1.1.23, <= 1.1.34; >= 1.2.0, <= 1.2.39; >= 1.3.0, <= 1.3.4; >= 2.0.0, <= 2.0.11; >= 11.0.0-M1, <= 11.0.17; >= 10.1.0-M7, <= 10.1.51; >= 9.0.83, <= 9.0.114), Snyk (>= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18; >= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:884b1992-1774-5088-a4b7-6c18367172a7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-24880 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6c506e91-632f-5de1-8566-34bf2d396c4b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-29129 (cipher preference order not preserved). The vulnerability was fixed in upstream commit 8d69b33764 (February 20, 2026) by Apache committer remm@apache.org, which changed HashSet to LinkedHashSet in SSLHostConfig.getJsseCipherNames() to preserve insertion order. This fix was already present in the upstream 10.1.55 release that Tu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:98c9d1c1-32e0-5969-939b-c1d03e68bd91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dc831074-0867-5fb4-91f9-744d5e99b4be",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41293 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target Tomcat 10.1.55 is not affected by CVE-2026-41293. The vulnerability (unvalidated HTTP/2 headers allowing invalid characters to reach the application) was fixed in the upstream Apache Tomcat 10.1.55 release via commit 19f17a257797e8d139b33ff9c88d362a273be148 by Mark Thomas (markt@apache.org). TuxCare onboarded this version with the fix already present. All required validation code is in place: HPackHuffman.java and HpackDecoder.java validate characters during HPACK decoding, rejecting field names with non-token or uppercase characters and field values with invalid characters, and Http2Parser.java properly handles validation exceptions by throwing StreamException with PROTOCOL_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d9453c9d-041d-55d3-98d7-2324955c1c6d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65637 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.2"
    }
  ]
}