{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c790ffe2-edcf-5229-86a4-3788ee89aefe",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2",
      "version": "10.1.16-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.16",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1b0d00df-f8f6-543d-837a-20f55f5d352b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is NOT present in Tomcat 10.1.16. The XSS vulnerability via unescaped name parameter in host-manager was fixed by Apache upstream in June 2008, with escaping logic refactored to a centralized Escape utility in October 2017. The target version 10.1.16 (released November 2023) includes this upstream fix. All user input in HTMLHostManagerServlet is properly escaped using Escape.htmlE...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a7f3485a-0fea-51d5-a9e1-a6eea885581f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE vulnerability) is not present in Tomcat 10.1.16. The fix was introduced by Apache in commit 05c84ff830 (December 2013) and was already included in the upstream Tomcat 10.1.16 release. The defense mechanism (LocalResolver with blockExternal=true) is active by default for all primary XML parsing entry points: web.xml, *.tld, *.jspx, *.tagx, and tagplugin.xml. External entity re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cd5ffc50-3564-59c4-9e04-9b5da8f85506",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is not present in Apache Tomcat 10.1.16. The vulnerability allowed directory traversal via paths like `/a/../..` that normalize to `/..` after resolution. The upstream patch (Sep 2015) moved validation checks to after normalization. Tomcat 10.1.16 contains a refactored version of this fix (Apr 2016, commit 47ecd0d0f9) that adds a trailing slash to paths ending with `/.` or `/..`, ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4f8477bf-9ca8-5637-b5a3-c092bc271ab9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 10.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-jrcp-c39h-r29x (affected up to 9.0.0.M2), NVD (affected up to 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a179582b-354f-5390-ab5b-f982a1514552",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is NOT present in Apache Tomcat 10.1.16. The vulnerability required StatusManagerServlet to be missing from the RestrictedServlets.properties list, allowing unprivileged applications to load it and access session data. The upstream fix (commit c8601f802d by Mark Thomas on Jan 4, 2016) added the restriction line and was already included in the Tomcat 10.1.16 release that TuxCare on...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7a70efd1-2fa7-5cf3-a81c-d2b6b7aa87aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2016-0762. The vulnerability (timing attack to enumerate valid usernames via skipped password processing when username doesn't exist) was fixed by upstream Apache in commit 86b2e436 (August 2016), which shipped in the upstream release 10.1.16 that TuxCare onboarded. All affected Realm implementations (RealmBase, DataSourceRealm, MemoryRealm) now call...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c0c0e9c7-95c4-5eba-b9d6-4fad5e8018fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 10.1.16. The vulnerability required authorization check for setGlobalContext() is already present in the target. The fix (commit 76ebc900) was authored by upstream Apache developer kkolinko@apache.org and shipped in the upstream Tomcat 10.1.16 release that TuxCare onboarded. The SecurityManager permission check prevents unauthorized web applications from m...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:61ac31bf-e3bc-5caa-a2ce-0b83913c5065",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is not present in Tomcat 10.1.16. The vulnerability was fixed in upstream Apache Tomcat in July 2016 (commit c1660182010b4255c21c874d69c124370a67784a by Mark Thomas). The fix introduces a PermissionCheck interface and modifies SystemPropertySource to validate PropertyPermission against the web application's SecurityManager policy before returning system property values. WebappClas...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b645514d-085a-5bc6-9312-3075f6267bee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6796 is not present in Tomcat 10.1.16. The vulnerability allowed malicious web applications to bypass SecurityManager via manipulation of JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The upstream fix by Mark Thomas (commit f603f2f4595, 2016-08-30) was already included in Tomcat 10.1.16 when TuxCare onboarded it. Both security checks are present: JspServlet ignores engineOptionsClass parameter and EmbeddedServletOptions ignores scratchdir parameter when Constants.IS_SECURITY_ENABLED is true.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3faae4db-0856-5106-8dd8-e55b4660ba2f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.16 is not affected by CVE-2016-6797. The vulnerability concerned unauthorized access to global JNDI resources when ResourceLinkFactory did not validate whether a web application had an explicit ResourceLink configured. The fix was added by Apache Tomcat in August 2016 (commit 2859ac3eae by Mark Thomas, Apache committer). Version 10.1.16 was released in November 2023, more than 7 years after the fix was committed. The defense mechanism (per-ClassLoader registry with validateGlobalResourceAccess checks) is fully present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1392ee5a-3de0-5c5a-856c-6da15d8f0fb9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Target Tomcat 10.1.16 does not contain CVE-2016-6817 vulnerability. The fix for the HTTP/2 header parser infinite loop (bug 60232) was authored by Apache upstream developer Mark Thomas (markt@apache.org) in commit 079372fc7b and was already present in the upstream Tomcat 10.1.16 release before TuxCare's onboarding. The vulnerable code pattern\u2014where headerReadBuffer.remaining() == 0 causes toRead = 0 and an infinite loop\u2014is not present. The target code at java/org/apache/coyote/http2/Http2Parser.java lines 497-509 includes the buffer expansion logic that prevents the infinite loop, and lines 656-657 include the buffer reset mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:10da7158-0b23-504b-a7ac-bc93583975d8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-8747 does not affect Tomcat 10.1.16. The vulnerability only affected Tomcat 8.5.7-8.5.9 and 9.0.0.M11-M15. The fix (commit 452c8094) was applied by upstream Apache in December 2016, nearly 7 years before Tomcat 10.1.16 was released in November 2023. The fix was already present in the upstream release that TuxCare onboarded, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:46f651c8-904c-5600-8bd3-2245a008721b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5647 is NOT present in Apache Tomcat 10.1.16. The vulnerability affected Tomcat versions up to 9.0.0.M18, 8.5.12, 8.0.42, 7.0.76, and 6.0.52. The fix (commit 864aa1199a by Mark Thomas) was applied upstream in March 2017 and is present in the 10.1.16 release that TuxCare onboarded. All fix components are verified: SendfileKeepAliveState enum with PIPELINED state, Http11Processor detection of buffered pipelined data via available() check, and endpoint handling that immediately processes pipelined requests instead of discarding them. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3ed6ebf1-9d6a-5173-98e6-caaa411d00c3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5650 is NOT present in Apache Tomcat 10.1.16-tuxcare.1. The vulnerability affected Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 where HTTP/2 GOAWAY frames did not close streams waiting for WINDOW_UPDATE, causing thread exhaustion. The upstream fix (commits c909f01471 and 51eba9b70c by Mark Thomas, March 2017) is present in the target: (1) goaway() method calls close() at line 1827, and (2) close() method resets all streams at lines 1283-1289. These commits are ancestors of the first TuxCare onboarding commit (e1463febbc3e1eee03c0ab70053f4c612e8a66e0), confirming the fix was already in upstream Tomcat 10.1.16 when TuxCare onboarded it. No reverts found; Http2AsyncUpgradeHandler inherits the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:690a8d10-d44c-5d07-959c-2c0ebd5e697a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Apache Tomcat 10.1.16. The vulnerability, which allowed HTTP methods like PUT/DELETE on error pages to potentially modify or remove static error page files, was fixed in upstream Apache Tomcat in May 2017. The fix (commit 7d93527254 by Mark Thomas) was already included in the Apache Tomcat 10.1.16 release that TuxCare onboarded. Both DefaultServlet and WebdavServlet correctly override the service() method to force error dispatches through doGet() regardless of the original request method, preventing write/delete operations on static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:83cc7f12-2538-5bb1-b651-fbdc0ee49fbf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Version 10.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-73rx-3f9r-x949 (affected below 9.0.0.M22), NVD (affected up to 9.0.0-milestone21), CVE record (affected up to 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9b7e601c-8028-565e-b47a-56c3392fcf60",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in Apache Tomcat 10.1.16. The vulnerability involved HTTP/2 path parameter handling that allowed directory traversal attacks by bypassing security checks. The fix (converting URI processing from string-based to byte-based to preserve path parameters during security validation) was already present in the upstream Apache Tomcat release 10.1.16 when TuxCare onboarded it. The fix is at java/org/apache/coyote/http2/Stream.java:394-399, authored by upstream developer Mark Thomas (markt@apache.org) in commit cf181edc9a on May 24, 2017.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a0fa8523-8fc9-5df0-898e-3392ced6bcf9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command in Apache Tomcat, which echoed environment variable values without HTML entity encoding, enabling XSS attacks. The target repository (Tomcat 10.1.16-tuxcare.1) already contains the upstream fix introduced by Mark Thomas (markt@apache.org) in commit 15fcd166 on March 11, 2019. The fix adds HTML entity encoding via the SSIMediator.ENCODING_ENTITY par...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33f29049-c39f-5504-b324-f666313e419a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 10.1.16 is NOT affected by CVE-2019-17569. The vulnerability affected only versions 9.0.28-30, 8.5.48-50, and 7.0.98-99 due to a regression in Transfer-Encoding header validation. The fix (commit 3c295d913e by Mark Thomas) was applied upstream on Dec 17, 2019 and was already present in the upstream Tomcat 10.1.16 release when TuxCare onboarded it. The current code properly validates Tran...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:243a09ca-a272-5e50-9b95-39225a57f44e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Tomcat 10.1.16 is not affected by CVE-2020-11996. The vulnerable algorithmic complexity pattern never existed in the 10.1.x branch. The target uses streams.subMap() to efficiently iterate only over actual existing streams between two stream IDs, preventing the unbounded loop attack that could cause CPU exhaustion with large stream IDs. This safe implementation was present from the first 10.1.x release (10.1.0, September 2022), over 2 years after the CVE was fixed in May 2020.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6c20b368-4ef1-56a8-a7ae-5d212fc0e380",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, and 8.5.1 to 8.5.56 due to a resource leak when handling direct h2c connections. The target version 10.1.16 is not affected because the upstream fix (commit c9167ae30f) was already present in the 10.1.16 release. The fix adds a release(processor) call to properly recycle the HTTP/1.1 processor before creating the HTTP/2 upgrade processor, preventing memory exhaustion from accumulated unreleased processor objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:91b264c4-35f5-590d-a9de-0ed77dbdc151",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13935 is not present in Apache Tomcat 10.1.16. The fix for this WebSocket payload length validation vulnerability was already included in the upstream Apache Tomcat 10.1.16 release. The vulnerable code pattern (missing MSB validation for 64-bit payload lengths) does not exist in the target because the upstream fix by Mark Thomas (commit 1c1c77b0ef) was shipped with the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ba9981ae-daf0-5b7a-9ad5-66d2b1e8220b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Version 10.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-qxf4-chvg-4r8r (affected below 9.0.31), NVD (affected up to 9.0.30), CVE record (affected up to 9.0.30), Snyk (affected below 9.0.31).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:be3c4a9d-69da-598f-b9c3-330e80d9cb22",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.16-tuxcare.2."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec7f61fc-1de2-537f-a490-276497b472ef",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2021-30639 is NOT present in Tomcat 10.1.16. The vulnerability was a regression in versions 8.5.64, 9.0.44, and 10.0.3-10.0.4 where the errorException field was not reset in Request.recycle(), causing all subsequent requests on the same Request object to fail after a non-blocking I/O error. The fix (adding `errorException = null;` in recycle()) was applied by Apache in March 2021 (commit b59099e4ca). This fix was already present in upstream Apache Tomcat 10.1.16 when TuxCare onboarded it in October 2026. The target contains the complete fix at java/org/apache/coyote/Request.java:810.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c5d8e701-177b-5d67-abdb-671b64a44a01",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 describes an LDAP injection vulnerability in Tomcat's JNDI Realm that allows authentication using variations of valid usernames (e.g., \"t;\" or \"t*\" instead of \"test\"). The vulnerability stems from missing escaping of LDAP meta-characters in usernames before constructing LDAP queries. The target repository (Apache Tomcat 10.1.16) is NOT AFFECTED because the fix was already present...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b0003a5c-f475-5e09-a356-3e9f96974c95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in target Tomcat 10.1.16. All three vulnerability patterns have been fixed by upstream Apache commits that shipped in the upstream 10.1.16 release, prior to TuxCare onboarding. The fixes include: (1) rejection of \"identity\" transfer encoding with 501 error, (2) processing Transfer-Encoding headers from HTTP/1.0 clients (not just HTTP/1.1), and (3) ensuring chunked ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6eec285d-3ddc-512a-8c7f-4f8e17e410dc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.16 is not affected by CVE-2021-41079. The vulnerability affects versions 10.0.0-M1 to 10.0.2, but both fixes that address the infinite loop issues in OpenSSLEngine.unwrap() were already present in the upstream Apache Tomcat codebase before TuxCare onboarded version 10.1.16. The first fix (commit 5ee9947fee) was released in 10.0.1, and the second fix (commit 34115fb3c) was released in 10.0.3, completing the remediation. Since 10.1.16 is significantly newer than the affected range and contains both upstream fixes, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d1d03e19-438a-5131-8cac-134424ea1f1a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2021-42340 describes a memory leak where WebConnection objects created for HTTP upgrade (WebSocket) connections are not released when connections close, leading to OutOfMemoryError. The fix requires storing the WebConnection reference during init() and explicitly closing and nullifying it in destroy(). This fix is already present in Apache Tomcat 10.1.16 at lines 102 and 216-224 of WsHttpUpgradeHandler.java. The target version (10.1.16) was onboarded from upstream Apache Tomcat after the fix was applied in September 2021, so the vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M1, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72), NVD (>= 8.5.60, < 8.5.72; >= 9.0.40, < 9.0.54; >= 10.0.1, < 10.0.12; = 10.0.0-milestone10; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5), cve.org (>= 10.0.0-M10, <= 10.0.11; = 10; >= 10.1.0-M1, <= 10.1.0-M5; = 10; >= 9.0.40, <= 9.0.53; = 9; >= 8.5.60, <= 8.5.71; = 8), Snyk (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M10, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ed277c82-94c6-59a7-b6d3-709e6ec9cd6f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 (processor sharing concurrency bug) is NOT present in Tomcat 10.1.16. The upstream fix commit 17f177eeb7 from March 2022 was already included in the upstream Tomcat 10.1.16 release that TuxCare onboarded in October 2026. The fix uses AtomicReference for thread-safe processor ownership and the atomic takeCurrentProcessor() method to prevent concurrent access. This is an upstream f...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fe1028cb-10be-50b8-8f07-2be280d36e22",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23181 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.16 is NOT AFFECTED by CVE-2022-23181. The TOCTOU vulnerability in FileStore session persistence was fixed in upstream Apache Tomcat before version 10.1.16 was released. The fix (commit 70da1aaa51 by Mark Thomas) eliminates the race condition by storing the canonical file once and using it consistently for both validation and file operations. The target version (10.1.16) is later than the affected range (10.1.0-M1 to 10.1.0-M8) and includes the upstream fix in the onboarded release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:20bd3307-d658-5359-b333-adc6020dfd59",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2022-25762 affects Apache Tomcat 8.5.0-8.5.75 and 9.0.0.M1-9.0.20. The target (Tomcat 10.1.16) is not affected because the fix was already included in the upstream release. The vulnerability pattern (socket use-after-close causing double-pooling) was eliminated by commit c2d6278b33 (2019-05-15) which introduced the CLOSED_NIO_CHANNEL sentinel pattern. This fix was authored by remm@apache.org (upstream) and shipped in all Tomcat 10.1.x releases. TuxCare's onboarding of 10.1.16 inherited this already-fixed code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8970f0ed-5788-51c4-a17d-733756c161d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-29885 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only vulnerability where Apache Tomcat's documentation incorrectly stated that the EncryptInterceptor enabled safe clustering over untrusted networks. The upstream fix (commit 0fa7721f11d565a2cd2e44366c388ad6a3e6357d by Mark Thomas) corrected the documentation to clarify that EncryptInterceptor only provides confidentiality and integrity protection, not DoS protection. This fix was included in Apache Tomcat 10.1.16 (released November 2023), which TuxCare subsequently onboarded. The target repository at version 10.1.16 SHA 5125fdef80a095c63d2b69d848c6377b57fd5f81 contains the corrected documentation. The misleading documentation (vulnerable pattern) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d59274a1-b6c9-513f-af30-a3a8ed9934a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 is NOT present in Apache Tomcat 10.1.16. The XSS vulnerability in the Form authentication example was fixed by upstream Apache in commit d6251d1cfb, which was already included in the Apache Tomcat 10.1.16 release that TuxCare onboarded. The vulnerable code (unescaped output of session and principal attributes) has been replaced with properly HTML-escaped output using util.HTMLFil...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bf96896c-341a-5999-abd6-57b59b996008",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:216d6e55-5fcb-5c48-af9e-c5439ea3fe04",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9c03f52a-3393-57e8-bd4b-4c829166372c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:41d71cf4-099f-55ed-8db0-d05650277859",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-54677 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a61fc7d7-f67a-5bcd-8275-ab5392663d05",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33b271d4-28a3-5e4d-b73d-b8b0d1e9df1f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fb01feae-7ae2-52e0-9f5e-18c37c2d5ba6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fff73bbb-f889-5e9a-9f5f-f05a9928ad5e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d465f4fb-dc97-5eb5-a97e-dec72953c234",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:46f0705d-98dd-5ff6-a843-9e9ffcf563f9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:49e1f1b2-e1ff-5540-a2a3-5c90bbb0561d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.16 does not contain the vulnerable code pattern. The CVE-2026-29129 vulnerability was introduced in later versions (10.1.51+, 9.0.114+, 11.0.16+) when TLS 1.3 cipher suite support was added via commit 4ee45c557168 on 2026-01-06. That commit introduced a bug where cipher lists were merged using HashSet (which doesn't preserve order) instead of LinkedHashSet. Version 10.1.16, ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ce35ba5d-b78e-59cd-8bf4-66880a8fc27c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aca2d2d5-b07e-5d22-9dae-636ac94b77d6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0d9c2439-c64f-56ed-a534-ed20d81d6766",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:084001db-b623-549b-8d9a-5f190d6f2d88",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ea86681d-1f8b-5682-b39b-7571d887b31d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34486 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ad1621ad-ebfe-58a6-8e6a-b2c802da1415",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a8c57fac-93ff-5fad-8bec-0219bef07896",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4c05ad60-8ef7-5dd3-af73-66843b37df02",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c729b93e-3a87-5163-bdc1-21174bca23b6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0f66e836-04d4-5521-9e4e-ab124155b4cd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8aafeed1-43ed-58de-bd86-ddf50137a70f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1a17821a-0eed-555d-b208-f29d7aae761b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f3467233-f17c-540d-8fa4-10a038c681d1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cbceae66-1e15-53e1-9693-c2769e54811d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a128b03e-a051-5274-94ab-390e1f69d339",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e096d613-97ff-5542-8051-afa68af14f57",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f61acd11-9507-55e0-81d4-54ed017e7da0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a99aea15-9d20-5c6c-891e-4db4ea7a9482",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:30ec2308-a9f3-5abb-a8b7-ef299a3979f0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5612f00f-4ca4-53f4-85c6-632fa66f13ea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 10.1.16-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4741cfba-4c46-5cdd-9b1c-4bd596d7f8de",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:69bddc5d-55f4-5dd6-a6a5-97c6e9bfbe3d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.2"
    }
  ]
}