{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:00060d3a-c503-56a8-bc5b-a972ce7c72e8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7",
      "version": "9.0.75-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.75"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:08d4c273-a2ba-550c-a0de-3f6ea9f4f516",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS via AJP requests with Content-Length: 0. The fix for this vulnerability is present in Tomcat 9.0.75-tuxcare.7. The fix (commit 8884dae60ac) was authored by upstream Apache developer Mark Thomas on 2014-03-17 and was already part of the upstream Tomcat codebase when TuxCare onboarded this repository in July 2025. The vulnerable pa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:12cd858c-aaa8-511f-8d20-0645603af63a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M12, and version 9.0.75 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fd455880-3977-5e43-8166-4a4c18d0664c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. The target Tomcat 9.0.75 is not affected by CVE-2017-5651. The vulnerability pattern (premature Processor recycling when sendfile completes quickly) was removed by upstream commit 9233d9d6a0 authored by Mark Thomas (markt@apache.org), which shipped in the upstream release before TuxCare's first maintenance commit. All patch changes are verified present in the target code: SendfileState tracking, modified while loop condition, processSendfile() method, and removed sendfileData clearing in prepareRequest().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5c76e4e1-84e2-5855-84bb-58f099e2a846",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Target version 9.0.75 is not affected by CVE-2019-0199. All required defense mechanisms (stream-level read/write timeouts and overhead frame tracking) are present in the target code. These fixes were committed to upstream Apache Tomcat in February 2019 (well before the 9.0.75 release in May 2023) and were included in the upstream release that TuxCare onboarded. The vulnerable code pattern\u2014indefinite blocking on stream I/O operations and unbounded overhead frame acceptance\u2014does not exist in this version. The CVE affected versions 9.0.0.M1 to 9.0.14; version 9.0.75 is well beyond this range and shipped with the fixes already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:811fd422-b9ee-589f-96f6-ceec733100ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:cc172946-0257-5d93-a03c-996bf1a4b0a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Version 9.0.75 is not vulnerable. Summary: CVE-2020-13943 is NOT present in this Tomcat 9.0.75 repository. The fix that moves the concurrent stream check from headersStart() to headersEnd() has been applied. The concurrent stream limit check now occurs in headersEnd() after all headers have been fully received and validated, preventing the header pollution vulnerability.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0e141576-186e-52ce-a16c-e9ca2a2c488e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.75 is not affected by CVE-2020-17527. The vulnerability affected versions 9.0.0-M1 to 9.0.39 and was fixed in 9.0.40 (November 2020) via commits d56293f816 and c78b27815c. The target version 9.0.75 (released 2023) already contains these upstream fixes. The vulnerable patterns (shared StringBuilder in HpackDecoder, non-concurrent EnumMap in ConnectionSettingsBase) are absent from the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:735a3e28-de43-5135-8429-6608c6e22170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 affects Apache Tomcat's h2c (HTTP/2 cleartext) connection handling where a shared mutable StringBuilder in HpackDecoder could cause request data leakage between concurrent users. The target repository (Tomcat 9.0.75-tuxcare.7) is NOT AFFECTED because the upstream Apache Tomcat 9.0.75 release already included the fix commits (d56293f816 from 2020-11-09 and d47c20a776 from 2021-01-14) before TuxCare onboarded this version. The vulnerable shared StringBuilder field has been replaced with thread-safe local variables, and the h2c processor lifecycle is properly managed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:3dc210fd-c1f8-5c34-af0f-04ba542d6aad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. The target is not affected by CVE-2022-42252. The vulnerability (acceptance of malformed Content-Length headers when rejectIllegalHeader=false) is not present because the upstream Apache Tomcat fix was already included in the release version (9.0.75) that TuxCare onboarded. The fix commit 4c7f4fd09d by Mark Thomas (markt@apache.org) adds special-case logic to always reject malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting, implementing RFC 9112 section 6.3 bullet 5 requirements. This fix is present at Http11InputBuffer.java lines 1038-1043 and predates all TuxCare commits in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:23da1f3d-df21-57d7-8be8-d5457d6ccf7c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.75 is not affected by CVE-2023-24998. The vulnerability concerns unlimited file upload parts causing DoS, fixed by adding fileCountMax validation. The fix was implemented by upstream Apache (Mark Thomas, commit cf77cc545de, 2022-12-13) and shipped in Apache Tomcat 9.0.75's upstream release. TuxCare onboarded version 9.0.75 with the fix already present. All fix components exist in the target: FileUploadBase has fileCountMax field/getters/setters and validation check (lines 318-321), Request.java has setFileCountMax integration (line 2862), and FileCountLimitExceededException class exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:859336e2-ec3b-5371-9bf6-1329cf23fe36",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 9.0.75 is NOT vulnerable to CVE-2023-28709. The fix for the off-by-one parameter counting vulnerability was already included in the upstream Apache Tomcat 9.0.75 release (tagged May 4, 2023). The fix commit (fbd81421629 by Mark Thomas, April 11, 2023) predates the first TuxCare commit in this repository's history, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:487c1add-6066-54ea-ac5e-273fadcb4ff8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2023-34981 describes a regression in bug 66512's fix where HTTP responses with no valid headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The target repository Tomcat 9.0.75-tuxcare.7 contains the upstream fix (bug 66591) authored by Apache committer Mark Thomas (markt@apache.org) on 2023-05-03. The fix was shipped in the upstream Apache Tomcat release that TuxCare onboarded, not applied as a TuxCare backport. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0a37c201-86c1-56e0-8481-5500dd0098bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42794 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f4c5cddb-96c7-59e3-8b9e-227250c8c8b3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:239d95a8-8f5e-5483-bb1e-f5d453727d67",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:499db711-32bc-5bfc-b1b6-0a054c625c1f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8811c4bc-15fe-5bcd-a26a-e9d5b1705792",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 9.0.0-M11 through 9.0.43, where incomplete POST requests could trigger error responses containing data from previous requests by other users. The target repository is at version 9.0.75-tuxcare.7, which is significantly higher than the fixed version 9.0.44. Both required fixes are present in the upstream 9.0.75 release: (1) Http11InputBuffer.java has the try-...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5b810736-197e-5f3d-9d09-116c38277759",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:71154fc9-c3b0-5c77-899d-5906e2ac7703",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6cc14588-1547-5b01-ab07-0b2a683f5f93",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2e9c9263-a539-5573-96f4-3aabaa21fdb6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not reuse HTTP/2 request and response objects across streams, preventing the cross-user mix-up. Each stream creates fresh Request and Response objects in java/org/apache/coyote/http2/Stream.java:115. Stream.recycle() only replaces the stream with a RecycledStream and does not reset or return request or response objects to a pool (java/org/apache/coyote/http2/Stream.java:753).",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1f88574d-81fe-5bbc-a0fd-b5e8f690be05",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat version 9.0.75 is not affected by CVE-2025-31650. The vulnerability requires HTTP/2 PRIORITY_UPDATE frame handling code (RFC 9218) that was introduced in version 9.0.76. Version 9.0.75 does not implement PRIORITY_UPDATE frames and therefore cannot exhibit the memory leak vulnerability.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ac2a1ac3-5c79-533c-a63d-50c96fe6a943",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0fefe041-e911-5cef-b740-72662682d619",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8bac1f0e-777d-527c-bd85-0f667f0baf11",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6212c7b2-7ad1-5284-b5a1-5022d997e04e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66614 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:10dfe1e0-4bb7-58b2-9665-39c896d9a3b8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9ae26b1f-79ba-5c0a-979d-572dcc41c1dd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24734 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:833f4707-266f-58f2-8c5e-411b978c0f74",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24880 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fdb05ac8-89a2-5f16-8bc6-ef37216eb8bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.75 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 9.0.114 when TLS 1.3 cipher suite support was added (commit 4ee45c5571, Jan 6 2026), which used a HashSet in getJsseCipherNames() that failed to preserve cipher ordering. Version 9.0.75 predates this feature by 39 minor versions and uses a simpler, non-vulnerable code path that maintains cipher o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:28096cfd-3bf5-5d1d-81a0-e0cdfc242f77",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7b5cffcd-1194-5a4a-b974-763d681848fd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a82a7cd4-c18b-51ce-93c9-d86380910974",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65637 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CNA title explicitly scopes this CVE to an HTTP/2 no-authority bypass of strict SNI validation (records/cve.json:1). HTTP/2 requests reach receivedEndOfHeaders(), which lacks the supplied patch\u2019s serverName null check, so the authority hardening is absent (Http2UpgradeHandler.java:1777; Stream.java:508; patches/02-8639b20f045c.patch:20). However, searching java/ found neither checkSni nor strictSni, and the complete HTTP/2 request validator performs syntax checks before calling the adapter without comparing authority against SNI (StreamProcessor.java:470; StreamProcessor.java:424). The TLS path uses SNI to select SSLHostConfig and its certificate, with exact, wildcard, and default configuration lookup (AbstractJsseEndpoint.java:116; AbstractEndpoint.java:482). Request mapping explicitly substitutes the default host when the request host is null (Mapper.java:654).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.75-tuxcare.7"
    }
  ]
}