{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:640a5264-86d0-560a-9f6e-c052d4a69416",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7",
      "version": "9.0.83-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.83"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:33783f28-dded-56b4-b213-ca74a394f587",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 is not present in Apache Tomcat 9.0.83. The vulnerability, which caused thread hangs when processing AJP requests with Content-Length: 0, was fixed by upstream Apache in commit 8884dae60a on March 17, 2014 (authored by Mark Thomas). This fix was already included in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded, more than 11 years before TuxCare began maintenance...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:af1813ab-194c-58be-9f80-af99cd908efe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Prechecker: The upstream fix is already in this version's source history (commit 516bda67). The upstream fix was released in 9.0.0.M12, and version 9.0.83 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:34f00647-7742-5e03-85ae-6363b59abb12",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 is not present in Tomcat 9.0.83. The vulnerability involved a race condition where the Http11Processor could be added to the processor cache twice during fast sendfile completion, leading to response mix-up between different client requests. The upstream Apache Tomcat project fixed this issue in commit 9233d9d6a0 (March 24, 2017) by tracking sendfile state separately from the sendfileData field that gets cleared during processor recycling. This fix was already present in the upstream release before TuxCare onboarded version 9.0.83. The target code correctly implements all fix elements: SendfileState tracking, while loop condition checks, proper return status determination, and the processSendfile() method that prevents double-caching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0dd561b3-b833-542d-95ff-73e474bccd1f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 is NOT present in Apache Tomcat 9.0.83. The vulnerability affected versions 9.0.0.M1 to 9.0.14 (and 8.5.0 to 8.5.37). Apache fixed this in February 2019 by adding stream-level read/write timeouts and overhead frame tracking to prevent thread exhaustion DoS. All three defense mechanisms are present and functional in version 9.0.83: (1) stream read timeout enforcement at Stream.java:1247-1262, (2) stream write timeout enforcement at Stream.java:254-259, and (3) overhead frame limit enforcement at Http2UpgradeHandler.java:388-392. These fixes were authored by Apache committer Mark Thomas and shipped in the upstream 9.0.83 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:cbbac35d-4582-5978-b80b-2b0f91d82f59",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 is not present in Tomcat 9.0.83-tuxcare.5. The vulnerability affects Tomcat 9.0.0.M5 to 9.0.36 where h2c direct connections did not release the HTTP/1.1 processor after upgrading to HTTP/2, causing memory exhaustion. The upstream Apache fix (commit 172977f0 by Mark Thomas, released in 9.0.37) that adds release(processor) before creating the upgrade processor is already present in the target at AbstractProtocol.java lines 945-946. Since version 9.0.83 is well after the affected range and inherits the vendor fix from upstream, the target is not affected.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:beb844fd-3349-55b3-96a1-616cc734ebc0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2020-13943 is NOT present in Apache Tomcat 9.0.83-tuxcare.5. The vulnerability affected Tomcat versions up to 9.0.37 and was fixed in 9.0.38 (July 2020) by upstream Apache. The target version 9.0.83 is based on the upstream Apache Tomcat 9.0.83 release (November 2023), which already contains the fix. The concurrent stream limit check has been correctly moved from headersStart() to headersEn...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:cb19c092-1d93-5aa2-974d-91dd4c571835",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527 does not affect Apache Tomcat 9.0.83. The vulnerability involved HTTP/2 request header value reuse between streams due to shared mutable state (StringBuilder in HPACK decoder, non-thread-safe EnumMap in connection settings, and incorrect buffer handling during protocol upgrades). All three fix commits (d56293f816, c78b27815c, d47c20a776) were applied by upstream Apache Tomcat (author: Mark Thomas, markt@apache.org) in November 2020 and January 2021. These fixes shipped with the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5a6d91a0-c46e-596e-ba27-188bcf1b2afd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 is not present in Tomcat 9.0.83-tuxcare.6. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.41 and involved shared mutable state in h2c connection handling causing cross-request data leakage. All three upstream fixes (HpackDecoder concurrency fix, ConnectionSettingsBase thread-safe collections, and AbstractProtocol processor lifecycle management) were committed by Mark Thomas (markt@apache.org) and shipped in upstream Tomcat 9.0.83 before TuxCare onboarded this version. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:36558290-4a74-579c-aaaf-2f2b07868fd0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 9.0.83 is not affected by CVE-2022-42252. The vulnerability (accepting malformed Content-Length headers when rejectIllegalHeader=false, enabling request smuggling) was fixed by upstream Apache in commit 4c7f4fd09d, which is present in the 9.0.83 release. The CVE affects versions 9.0.0-M1 to 9.0.67; version 9.0.83 is beyond this range and contains the upstream fix. The fix forces rejection of all malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting, as required by RFC 9112 section 6.3 bullet 5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:db9c6611-098d-520f-bad8-3bf657917c6b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.83 is not affected by CVE-2023-24998. The fix for unlimited file upload parts (DoS vulnerability) was already present in the upstream Apache Tomcat 9.0.83 release. The fix adds fileCountMax limiting in FileUploadBase and wires it through Request.java to enforce maxParameterCount (default: 10,000). The vulnerable code pattern (unbounded iteration over multipart parts) is not present because the upstream fix (commit cf77cc545d by markt@apache.org, Dec 2022) was included in the 9.0.83 release (Nov 2023) before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:704f4add-eb86-558f-a731-7f361342db9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Target is not affected by CVE-2023-28709. The vulnerability is an off-by-one error in parameter count limit enforcement that allows exactly one parameter beyond the configured maxParameterCount. The upstream Apache Tomcat 9.0.83 release already contains the fix (commit fbd8142162 by Mark Thomas, April 11, 2023), which reorders the limit check to occur before incrementing the counter and changes the comparison from `>` to `>=`. This fix was shipped in the upstream release before TuxCare onboarded version 9.0.83.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c2048de6-acc0-594a-b5c5-2b1661ac64a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. The target (Tomcat 9.0.83) is not affected by CVE-2023-34981. The vulnerability was a regression in bug 66512's fix that caused AJP SEND_HEADERS messages to be skipped when responses had zero HTTP headers, leading to header reuse from previous requests. This regression was fixed in upstream commit 2f0ca23784 (bug 66591) which shipped in Tomcat 9.0.75. Since the target is version 9.0.83, the fix was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f14aa1be-7dac-52a5-9079-6b88ab9c8494",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 is NOT present in Tomcat 9.0.83. The vulnerability affects Tomcat 9.0.70-9.0.80, where a missing finalize() method in DiskFileItem causes temporary uploaded files to persist indefinitely on Windows when applications fail to close streams, leading to disk exhaustion DoS. The fix (adding a finalize() method for automatic cleanup) was introduced in upstream Tomcat 9.0.81 via commit ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8751fc5d-25f8-5a21-a946-0ff3b9b26b48",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.83 is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset). The fix for this vulnerability was included in the upstream Apache Tomcat 9.0.83 release and was present when TuxCare onboarded this version. The fix implements rate-limiting for HTTP/2 RST_STREAM frames using an overhead counter with a configurable reset factor (default 50), preventing attackers from exhausting server resources through rapid stream creation and cancellation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:51752718-3968-5dfa-ae47-86bdaeca3992",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:304aa6c1-9849-58df-b07a-2cbce0abf58e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2023-46589 is not present in target Tomcat 9.0.83. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which adds character validation for trailer header names and values in ChunkedInputFilter.java, was included in the upstream Apache Tomcat 9.0.83 release (November 2023) via commit 59583245639d by Mark Thomas. The target repository is based on this upstream release and inherits the fix. The vulnerable code pattern (missing validation) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:70453492-bae2-552c-b7a1-4758d3f911f0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11-9.0.43, fixed in 8.5.64+ and 9.0.44+. The target is Tomcat 9.0.83-tuxcare.6, which is well above the fixed version threshold. Both upstream fix commits (ErrorReportValve IS_IO_ALLOWED checks and Http11InputBuffer try-finally buffer state protection) are present in HEAD and were shipped in the upstream Apache Tomcat release, not add...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e6af597e-13d5-5d5d-b0bc-439fe5ab9ae1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a4a4c095-100b-529a-ac85-40162fca8fb4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:51d8aa44-da8a-5d14-8d0e-3fe00ece89d7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d0a32f3e-a9ca-5523-8d16-dc8eef2c28cf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Version 9.0.83 is NOT affected by CVE-2024-52317. The vulnerability was introduced in version 9.0.92 (July 24, 2024) when commit 3c5b14b713 added HTTP/2 request/response recycling and reuse functionality. Version 9.0.83 predates this feature and does not recycle/reuse request/response objects between streams, so the attack chain leading to data mix-up between users does not exist. The CVE's sta...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d4370c18-6f29-5227-b2e7-fbf54441d43f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31650 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0114be6b-7f25-5988-8ef6-839e0f9169ea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:eb8b9972-e75f-5cbd-a599-f720e556ded1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:283ffd70-c44f-52e8-8edd-23580e0faa00",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7b8c6400-ee4d-594b-9a87-cae47a7e2180",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:3f7556f9-6ee5-5117-aefb-601436b9b717",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ccd94e52-3076-5e5d-9750-e3f5152b43ad",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24734 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e729c273-15bd-54de-9102-9f2a524e0bf8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24880 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4ff5fe0f-f2a6-5053-81ae-a43f1163d6b5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.83 is NOT AFFECTED by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved due to using HashSet instead of LinkedHashSet when merging TLS 1.3 cipher suites with regular ciphers. However, version 9.0.83 does not contain the vulnerable code pattern because TLS 1.3 cipher suite merging functionality was introduced after this version, around 9.0....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:284f81c3-870b-5c41-afa9-7032150939b7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9630d622-6635-5949-bd36-8f3be4bce66f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:eca551e7-69f6-5cd0-80bd-a59a26879952",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65637 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.7"
    }
  ]
}