{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2b2f4f83-2ebe-52bb-b438-03a396d23580",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10",
      "version": "10.1.18-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.18",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1da5057e-8ce9-5da4-b007-4ef025b23918",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in the host-manager application where the hostname parameter was rendered in HTML without proper escaping. This vulnerability was fixed by Apache upstream in 2008 (commit 49c71fc59c by Mark Thomas). The target version 10.1.18 already contains this fix, which was present in the upstream release when TuxCare onboarded it in December 2025. All code paths that ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:57232e11-de66-5039-95f7-0528dee765e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE in XML configuration file parsing) is NOT present in Tomcat 10.1.18-tuxcare.10. The vulnerability allowed attackers to obtain \"Tomcat internals\" information via external entity declarations in XML files (web.xml, *.tld, *.jspx, *.tagx, context.xml). The fix adds a `blockExternal` parameter throughout the XML parsing stack, defaulting to `true` in Tomcat 10.x. The `LocalResolv...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:cd8246c6-224b-57c8-b3b9-e4047446993d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 10.1.18 is not affected by CVE-2015-5174. The vulnerable code pattern (checking for `/.` and `/..` BEFORE path normalization) is not present in this version. The upstream Apache Tomcat project released a refactored fix in April 2016 (commit 47ecd0d0f9) that replaced the vulnerable logic with an equivalent defense using the `addedTrailingSlash` approach. This fix was already included in T...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:538346b8-c5b7-51d7-b2bb-75844181e152",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 10.1.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-jrcp-c39h-r29x (affected up to 9.0.0.M2), NVD (affected up to 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:01898815-4b9a-5936-bf2b-1694c38d511f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is not present in Tomcat 10.1.18-tuxcare.10. The vulnerability required StatusManagerServlet to be unrestricted, allowing unprivileged web applications to load it and read sensitive HTTP request data including session IDs. The fix (adding StatusManagerServlet to RestrictedServlets.properties as a restricted servlet) was applied by upstream Apache in commit c8601f802df5 (January 20...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:0a5de35e-7f15-543f-81c0-058b438dacf1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 10.1.18. The fix was authored by upstream Apache developer Mark Thomas in August 2016 (commit 86b2e436) and was already included in the Tomcat trunk before TuxCare onboarded version 10.1.18. All Realm implementations that perform local password checking (RealmBase, DataSourceRealm, MemoryRealm, UserDatabaseRealm) contain the def...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:6b0cd9e1-150d-50cd-b395-93602298b88b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not present in Tomcat 10.1.18-tuxcare.10. The vulnerability involved the setGlobalContext method in ResourceLinkFactory.java not checking SecurityManager permissions before allowing modification of the global naming context. The fix (commit 76ebc9007567c8326217dd94844540e1e27d8468) was authored by Apache upstream developer kkolinko@apache.org on 2016-01-21 and was already inclu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:8f32eac8-2169-5e5c-ae21-297b420572ce",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.18) is NOT vulnerable to CVE-2016-6794. The fix for this SecurityManager bypass vulnerability was introduced by Apache upstream in commit c1660182010b4255c21c874d69c124370a67784a on July 28, 2016, and was already present in the Apache Tomcat 10.1.18 release (tagged January 5, 2024) that TuxCare onboarded. The fix introduces a PermissionCheck interface a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:864cf592-25d3-54e8-b956-7032427a97ee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. Target Tomcat 10.1.18 is not affected by CVE-2016-6796. The upstream fix (commit f603f2f4595073f9490e01699d2083112a7c09a7 from 2016-08-30 by Mark Thomas) is present in HEAD and was included in the upstream release before TuxCare onboarding. The fix adds SecurityManager-aware checks that ignore the engineOptionsClass and scratchdir servlet parameters when Constants.IS_SECURITY_ENABLED is true, preventing malicious web applications from bypassing SecurityManager restrictions via configuration parameter manipulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:5a9f3045-acc3-55e6-b981-0732d34e9fdb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in the target repository (Tomcat 10.1.18). The upstream fix by Mark Thomas (Apache) was already included in the upstream release that TuxCare onboarded. The fix adds per-ClassLoader validation to ResourceLinkFactory.getObjectInstance(), ensuring web applications can only access global JNDI resources they were explicitly configured to access. The vulnerable pattern (unrestricted global resource access) is not present because the complete fix was shipped in the upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:f2de9853-d106-57df-ac46-b1fb29801813",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2016-6817 is not present in Tomcat 10.1.18. The vulnerability, which caused an infinite loop in the HTTP/2 header parser when processing headers larger than the available buffer, was fixed in upstream commit 079372fc7b on October 20, 2016. This fix was already included in the upstream Tomcat 10.1.18 release before TuxCare onboarded it. The target contains the complete mitigation: dynamic buffer expansion in readHeaderPayload() and buffer reset in onHeadersComplete().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7f3e3c7e-df9d-5f43-8ed0-57eb55459e92",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2016-8747 is not present in Apache Tomcat 10.1.18. The vulnerability involved improper ByteBuffer state management in Http11InputBuffer.nextRequest() that could leak HTTP request data between requests on persistent connections. The upstream fix (adding byteBuffer.flip() after compact() to properly reset buffer boundaries) was committed by Mark Thomas on 2016-12-14 in commits 452c8094a665 and 98466fdc1e64, both of which were already present in the Apache Tomcat 10.1.18 release before TuxCare onboarded it (first TuxCare commit: 455b1de3631919bdedd51507149a4ed186f9f3f6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:10ec13a7-4bd0-5b5c-bf50-4752cda56ad7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2017-5647 is not present in Tomcat 10.1.18. The vulnerability (loss of pipelined HTTP requests when sendfile completes) was fixed in upstream commit 864aa1199a \"Improve sendfile handling when requests are pipelined\" by Mark Thomas (markt@apache.org). This fix was already included in the Tomcat 10.1.18 upstream release that TuxCare onboarded (commit 455b1de363). The fix introduces a SendfileKeepAliveState enum with three states (NONE, PIPELINED, OPEN) and checks available() to distinguish pipelined data in the buffer from waiting-for-more-data, ensuring pipelined requests are immediately processed instead of being lost.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1226390c-5399-5e2d-925a-67625e883efa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2017-5650 affects Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18. The vulnerability involves HTTP/2 GOAWAY frame handling not closing streams waiting for WINDOW_UPDATE, leading to thread exhaustion. The target (Tomcat 10.1.18) is NOT AFFECTED because the upstream vendor fix (commits c909f01471 and 5496e193a89 by Mark Thomas, March 2017) was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded. The fix ensures that when a GOAWAY frame is received, the connection's close() method is called, which iterates through all streams and resets them via receiveReset(Http2Error.CANCEL), releasing held threads. This fix has been present in the Tomcat codebase since 2017 and is included in all Tomcat 10.x releases.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:902079a5-4ab1-5127-b1bf-b6b9efbfeb65",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2017-5664 does not affect Tomcat 10.1.18. The upstream fix by Mark Thomas (commit 7d93527254) was already present in the upstream release before TuxCare onboarding. Both DefaultServlet and WebdavServlet contain the required DispatcherType.ERROR checks that force error dispatches through doGet() only, preventing state-modifying operations (PUT, POST, DELETE) from executing on error page resources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:fb46d033-5621-590d-b1cc-dcd5fb5eb6a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is not present in Apache Tomcat 10.1.18. The vulnerability (CORS filter failing to add Vary: Origin header, enabling cache poisoning) was fixed in upstream commit cc0ca014c9 (July 2018) by Mark Thomas (markt@apache.org). This fix was already present in the Apache Tomcat 10.1.18 release that TuxCare onboarded. The target code correctly adds Vary: Origin headers via ResponseUtil.add...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:42618600-6582-579b-8fd4-afe01466fdca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.18 is NOT affected by CVE-2017-7675. The vulnerability involved HTTP/2 path parameter handling that bypassed security constraints and allowed directory traversal attacks. The fix (Bug 61120) was already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded this version. The vulnerable pattern (using setString() for URI processing) has been replaced with the secure pattern (using setBytes() to enable proper path parameter processing and normalization security checks). Fix authored by upstream Apache developer Mark Thomas, not by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:f69da3f4-c5a9-5ab6-b491-1395e19e7043",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The vulnerability was fixed in upstream Apache Tomcat by commit 15fcd166ea (March 11, 2019) which added HTML entity encoding to variable values. This fix was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded (first TuxCare commit: 455b1de, dated after the ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:45835246-1ebc-5393-9fa5-de16d884127f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 affects Tomcat versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 due to a regression in Transfer-Encoding header validation. The target version (Tomcat 10.1.18) is not affected because the upstream fix (commit 3c295d913e1 by Mark Thomas on 2019-12-17) was already included in the Apache release that TuxCare onboarded. The vulnerable code pattern\u2014failure to check TokenList.p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:d610801d-a812-517a-bb53-eb4b8f14aa4b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 10.1.18) is not affected by CVE-2020-11996. The vulnerability, which allows attackers to cause high CPU usage through specially crafted HTTP/2 requests with large stream ID gaps, was fixed in the upstream Apache Tomcat project before version 10.1.18 was released. The fix (commit 31cab22e6a) uses ConcurrentNavigableMap.subMap() to iterate only over existing streams rather than all possible stream IDs in the gap, preventing the CPU exhaustion attack. This fix was already present in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b37bbaae-d27f-5bf4-b9a7-7ecba0008be0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2020-13934 (h2c direct connection memory leak) is NOT present in Apache Tomcat 10.1.18. The vulnerability was fixed upstream by Mark Thomas in commit c9167ae30f3b03b112f3d81772e3450b7d0e6a25, which shipped in the Apache Tomcat 10.1.18 release before TuxCare onboarded this version. The fix adds a release(processor) call to recycle the HTTP/1.1 processor before creating the HTTP/2 upgrade processor, preventing memory exhaustion. The vulnerable pattern (missing processor release) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:ab871f20-fdce-5207-a74b-f29622264539",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.18 is NOT affected by CVE-2020-13935. The vulnerability (missing validation of the most significant bit in 64-bit WebSocket payload lengths) is not present because the fix was already included in the upstream release. The validation check `if (payloadLength < 0)` is present at WsFrameBase.java:252-255, authored by Apache upstream (markt@apache.org) in commit 1c1c77b0ef on 2020-06-29, well before the Tomcat 10.1.18 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:54648c3e-29ea-58ba-9d11-e9554d947c96",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 is NOT present in Tomcat 10.1.18-tuxcare.9. The target contains all defense mechanisms from the upstream security patches: strict CRLF validation (rejecting standalone CR bytes), control character rejection in header values (via HttpParser.isControl()), and automatic removal of malformed headers. The fix was authored by markt@apache.org (Apache upstream) on Jan 6, 2020 and shipped...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:ea50ebd7-2597-5b41-8aa1-3cc57a8361f6",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.18-tuxcare.10."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:3cb1c507-c24c-501c-956c-c44f6aa9f2c3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2021-30639 is NOT present in this target. The vulnerability involved an errorException field not being reset in the Request.recycle() method, causing all subsequent requests handled by the same Request object instance to fail after a non-blocking I/O error (DoS). The fix adds 'errorException = null;' at line 810 of Request.java's recycle() method. This fix was authored by upstream Apache developer Mark Thomas (markt@apache.org) on 2021-03-24 (commit b59099e4ca) and was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded. Git ancestry confirms the fix commit is IN_UPSTREAM_RELEASE (ancestor of first TuxCare commit 455b1de3631919bdedd51507149a4ed186f9f3f6 \"Setup/10.1.18\"). The vulnerable pattern is absent from the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:2359d618-f207-57c7-a3d9-c1c29428b65e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat's JNDI Realm, allowing authentication bypass via username variations containing LDAP-special characters. The target (Tomcat 10.1.18-tuxcare.9) is NOT AFFECTED because the upstream fix was already present in Tomcat 10.1.18 when TuxCare onboarded it. The fix adds doAttributeValueEscaping() and doFilterEscaping() methods that escape LDAP-special characters (sem...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1bfd9410-2233-5c10-aaa9-b20c31e4edcf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 affects Apache Tomcat's HTTP transfer-encoding parsing, potentially enabling request smuggling. All three fixes (reject \"identity\" encoding, process Transfer-Encoding from HTTP/1.0, ensure chunked is final encoding) were committed by upstream Apache developer Mark Thomas (markt@apache.org) on 2021-05-10 in commits be8f733b8c, 1692e4e5b1, and c3bd168427. These fixes were already p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:e1e335ad-0b54-5804-8fba-88d6fdc05a9a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2021-41079 affects Apache Tomcat 8.5.0-8.5.63, 9.0.0-M1-9.0.43, and 10.0.0-M1-10.0.2. The target is Tomcat 10.1.18, which already includes both upstream fixes that prevent infinite loops in OpenSSL TLS packet processing. Fix commit 5ee9947fee (Jan 21, 2021) by remm@apache.org added the idx==endOffset check, and fix commit 34115fb3c8 (Mar 3, 2021) by markt@apache.org fixed the bytesRead==0 handling. Both fixes were present in the upstream Apache Tomcat 10.1.18 release tag (dd75fed1ae) before TuxCare's onboarding commit 455b1de363 (Dec 25, 2025). The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:10bd996a-9579-5ad4-a07a-bc8098c44703",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2021-42340 is NOT present in Tomcat 10.1.18-tuxcare.9. The vulnerability (memory leak from unreleased WebConnection objects in WebSocket connections) was fixed in upstream commit d5a6660cba7 (2021-09-27) by remm@apache.org. This fix was already included in the upstream Tomcat 10.1.18 release that TuxCare onboarded. The target code properly stores the WebConnection reference during initialization (line 102) and explicitly closes it during destruction (lines 216-224), preventing the memory leak described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M1, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72), NVD (>= 8.5.60, < 8.5.72; >= 9.0.40, < 9.0.54; >= 10.0.1, < 10.0.12; = 10.0.0-milestone10; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5), cve.org (>= 10.0.0-M10, <= 10.0.11; = 10; >= 10.1.0-M1, <= 10.1.0-M5; = 10; >= 9.0.40, <= 9.0.53; = 9; >= 8.5.60, <= 8.5.71; = 8), Snyk (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M10, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:90d3f5b5-20c6-5467-a623-cfb7beaad762",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.18 is not affected by CVE-2021-43980. The vulnerability fix (atomic processor ownership via AtomicReference and takeCurrentProcessor() method) was already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The fix prevents the concurrency bug where multiple threads could share the same Http11Processor instance, causing responses to be delivered ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:79b69513-5872-542c-bd35-b7040d7f5a05",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23181 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2022-23181 is NOT present in Apache Tomcat 10.1.18. The vulnerability (a TOCTOU race where the canonical file path is validated but the non-canonical file is returned and used) has been fixed by upstream commit 70da1aaa51e authored by Mark Thomas on 2022-01-12. This fix was already included in the upstream Apache Tomcat 10.1.18 release before TuxCare onboarded it on 2025-12-25. The target's FileStore.java (lines 336-353) correctly caches the canonical file and returns it after validation, preventing the TOCTOU vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:26990241-47ab-53c1-b961-7765276742d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2022-25762 affects Apache Tomcat 8.5.0-8.5.75 and 9.0.0.M1-9.0.20. The target is Tomcat 10.1.18, a much newer version where the vulnerability was fixed in upstream before release. All defense patterns from the fix patches are present: (1) NioChannel uses single close (no double socket close), (2) CLOSED_NIO_CHANNEL dummy object pattern exists, (3) connection tracking moved to SocketWrapper via atomic takeCurrentProcessor()/setCurrentProcessor(), (4) WebSocket close handling uses safe processor lifecycle management. The fix commit e2d5a040b9 (2019-05-22, author remm@apache.org) predates the first TuxCare commit by 4537 commits, confirming it shipped in the upstream release. Vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1c0aaea8-5700-5984-9cd4-448ee7d1277f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-29885 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only vulnerability where Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks. The target repository (Tomcat 10.1.18) contains the upstream fix authored by Mark Thomas (Apache) that corrected all four affected documentation files (changelog.xml, cluster-howto.xml, config/cluster.xml, security-howto.xml). The documentation now correctly states that EncryptInterceptor provides only confidentiality and integrity protection, not DoS protection. The fix commit (0fa7721f11) was already present in upstream release 10.1.0-M15, well before version 10.1.18 was released, and was included when TuxCare onboarded this version. Verdict: not_affected because the vulnerable pattern (misleading documentation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:3e48389d-fc4b-5d87-9ac5-9baf3e0f9166",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Apache Tomcat 10.1.18. The upstream fix by Mark Thomas (markt@apache.org) that adds util.HTMLFilter.filter() to sanitize user-controlled output was already included in the Apache Tomcat 10.1.18 release that TuxCare onboarded. All user-provided data (principal attributes and session attributes) is properly HTML-escaped before rendering in the Fo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7023390b-0b53-54c3-be98-454052ead78f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.18. The upstream fix from commit bb4624a9f3e (by Mark Thomas, 2023-08-22) was already included in the Apache Tomcat 10.1.13+ release series. When TuxCare onboarded version 10.1.18, the fix was already present in the upstream code. The defense code at FormAuthenticator.java:765-7...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:25f6800b-1168-555d-8d0d-67449e366bf0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:574b8f8c-5003-5fd2-b49e-84004570d016",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 (HTTP trailer header parsing vulnerability) is NOT present in Tomcat 10.1.18. The target version includes the upstream fix that was released in Tomcat 10.1.14. The fix adds strict validation to reject trailer headers with non-token characters in names and control characters (except tab) in values, preventing request smuggling attacks. This fix was authored by Mark Thomas (Apache ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a1338b36-deaa-5203-b733-a2f60710c9c0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-54677 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:c3668e5f-9e9d-5a83-b243-1bab960e3924",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:34cb1071-af09-50df-b3bf-603648eaa673",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b627799d-4e6b-581f-94b5-189c865fe26d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b7ec8b85-57bf-590d-977e-a323757f6f17",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a1ee94bc-8ad6-515b-aa24-03bc1bdc19cf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:91765382-b808-5cf0-aeab-8482224dbb45",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:e07ace8b-d366-516e-999b-102803b557eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.18 is NOT affected by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved when TLS 1.3 specific cipher configuration was added. The bug occurred because code used HashSet (which doesn't preserve order) instead of LinkedHashSet when merging TLS 1.3 ciphers with other ciphers. However, version 10.1.18 predates the TLS 1.3 specific cipher confi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:959e22a0-3a0b-51f9-ba42-affc807e6920",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9621078b-365b-541e-b745-83c21d4f903f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:cc1bfdeb-6c39-5ded-bd69-5124c5fee360",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:8438c31e-0acf-5c34-911c-1451ef12c715",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:bbe11bc1-99c1-517f-8cf9-c53a8dfcede6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34486 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:0138cddb-0b5b-5273-9bb9-571b59c23382",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:95d34b09-90a8-5468-b86f-68636fd00e20",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:ab131d6c-4e80-5da7-abcd-7e619c55000c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:416813d7-b9f7-52d0-aaf6-9fac1a80c765",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:cbeeca09-d4a1-52d0-b690-6555b3012681",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:7c0abe15-ffb5-5955-9131-81c5a9ce7688",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1fd9a157-de9b-518a-b520-62ea9806cfa2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a38b5802-d3c9-5877-9ffb-19582dffaa94",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:887a10be-79a7-56f0-9a6e-96b3ba572761",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:6d1219b8-b761-596f-b99b-075fe0890962",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b16b1cfa-9929-5a26-9f73-d93639454947",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:86beb522-b775-5adf-9080-c95e59198ab6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:26795917-db8a-50a4-aca1-da99b187c39d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b6dfabd2-1173-5287-8c28-f31999561afd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:be317a65-74e7-5517-966c-555dea5750d4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b6b0d717-a34e-51d8-9d45-23b2f8dcf94b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:63eb4a44-1306-54d1-99fe-1ead703819fa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.18-tuxcare.10 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.18-tuxcare.10"
    }
  ]
}