{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f2991bc4-6d95-59fe-a6e9-0c309e04646d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3",
      "version": "10.1.33-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:67ee27b5-765a-5464-a7f4-10eb9c5405c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 10.1.33. The vulnerability involved XSS via unescaped rendering of the hostname parameter in the host-manager HTML interface. The upstream fix (commit 49c71fc59c by Mark Thomas, June 2, 2008) was already present in version 10.1.33 when TuxCare onboarded it in October 2026. All user-controlled data (hostname, messages, aliases) is properly HTML-escap...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:77accabb-ac75-54f8-acfd-bff9257ea358",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE in XML parsing) is not present in Apache Tomcat 10.1.33-tuxcare.3. The vulnerability was fixed in upstream Apache Tomcat on 2013-12-09 by adding blockExternal entity resolution controls to LocalResolver. The fix was already present in the upstream 10.1.33 release (tagged 2024-09-03) that TuxCare onboarded. The defense (blockExternal=true by default in StandardContext) blocks ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:767fdb4f-71af-5e60-ac40-91d5bf8afa5c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is NOT present in Apache Tomcat 10.1.33-tuxcare.3. The vulnerability (directory traversal via obfuscated path sequences like //.., /./.., /a/../..) was fixed in upstream Apache Tomcat in September 2015 and April 2016 (commits 9418af24af and 47ecd0d0f9, both by Mark Thomas). The fix was already present in the upstream 10.1.33 release that TuxCare onboarded (commit 47a79a9e4c \"Onboa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:23406687-ee17-5d5e-8605-9a5bc790db3a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 10.1.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-jrcp-c39h-r29x (affected up to 9.0.0.M2), NVD (affected up to 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7e8b431f-272a-5ec9-81c6-2deed411bc2e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is NOT present in Tomcat 10.1.33-tuxcare.3. The vulnerability (StatusManagerServlet missing from the restricted servlets list) was fixed in upstream Apache Tomcat commit c8601f802d (2016-01-04) by Mark Thomas. This fix was already present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded (first TuxCare commit: 47a79a9e4c). The StatusManagerServlet is correctly l...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:10fc2ad5-2f84-575f-a67a-7297943f84ea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 (timing attack against Realm implementations) is not present in Apache Tomcat 10.1.33. The vulnerability allowed attackers to enumerate valid usernames by measuring authentication response time differences when usernames didn't exist versus wrong passwords. The fix adds password hashing operations even for non-existent usernames to equalize timing. This fix was applied by upstream...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4466962d-7b77-5704-b574-d2f8e1a85987",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Apache Tomcat 10.1.33-tuxcare.3. The vulnerability affects Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3. The target version (10.1.33) is much newer and already contains the upstream fix. The required SecurityManager permission check was added to ResourceLinkFactory.setGlobalContext by upstream Apache Tomcat commit 76ebc900 (Konstantin Koli...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b6518f6d-231d-5751-923e-f90386bca100",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794: Target Tomcat 10.1.33 is NOT AFFECTED. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions and read forbidden system properties through Tomcat's configuration file property replacement feature (Digester). The fix, which adds permission checking before returning system properties, was authored by Apache's Mark Thomas (markt@apache.org) in 20...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7c24abed-1e04-5891-8747-068e948f7c8d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6796 (SecurityManager bypass via JSP servlet configuration parameters) is NOT present in Tomcat 10.1.33. The upstream Apache fix, which ignores the 'engineOptionsClass' and 'scratchdir' parameters when SecurityManager is enabled, was already included in the Apache Tomcat 10.1.33 release that TuxCare onboarded. Both security checks are present in the target code at JspServlet.java:89-93 and EmbeddedServletOptions.java:667-670. The fix was authored by Mark Thomas (markt@apache.org) in commit f603f2f4595073f9490e01699d2083112a7c09a7, which predates the TuxCare onboarding commit 47a79a9e4c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:738fd52a-2b2f-52a7-8f32-eb58fe22f361",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Tomcat 10.1.33. The vulnerability affected older Tomcat versions (6.0.0-6.0.45, 7.0.0-7.0.70, 8.0.0.RC1-8.0.36, 8.5.0-8.5.4, 9.0.0.M1-9.0.0.M9) where ResourceLinkFactory allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was applied by Apache upstream in commit 2859ac3eae (Aug 22, 2016) and was already present in the Apache Tomcat 10.1.33 release that TuxCare onboarded. The target repository contains the complete fix: globalResourceRegistrations registry tracking per-ClassLoader resource access, validateGlobalResourceAccess() check before lookup, and registration/deregistration methods in NamingContextListener.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1a5f948d-2279-50dd-8ed6-05293876f603",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6817 affects Apache Tomcat's HTTP/2 header parser, causing an infinite loop when processing headers larger than the available buffer. The target (Tomcat 10.1.33-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream Apache Tomcat 10.1.33 release before TuxCare onboarded it. The vulnerable code pattern (infinite loop when buffer is full) has been replaced with dynamic buffer expansion logic that prevents the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5c1dfa6f-8fd3-5a23-8da5-d647feb3122b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 through improper buffer state management in Http11InputBuffer.java's nextRequest() method. The vulnerability allowed information disclosure where data from one HTTP request could leak into another in reverse-proxy configurations. The target version (10.1.33-tuxcare.3) is not affected because the upstream fix was already present when TuxCare onboarded this version. Commit 452c8094a665 by Mark Thomas (Apache upstream) added the critical byteBuffer.flip() call after compact() on 2016-12-14, which prevents the buffer state corruption. This fix predates the first TuxCare commit (47a79a9e4c43 \"Onboard version 10.1.33\" by ikashchyeyev@cloudlinux.com) and is therefore an upstream fix that shipped in the Tomcat 10.1.33 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8c51af5c-c821-5f5b-9bf5-2741e8359de9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5647 is not present in Apache Tomcat 10.1.33. The vulnerability involved loss of pipelined HTTP requests during sendfile processing, causing responses to be matched with wrong requests. The fix was introduced in upstream Apache Tomcat commit 864aa1199ad2cccc9a7e7c6b977f7d7f812c9910 (March 27, 2017) and shipped with the upstream release before TuxCare onboarded version 10.1.33. The target contains the complete fix including the SendfileKeepAliveState enum (with NONE/PIPELINED/OPEN states), proper state tracking in Http11Processor based on pipelined data availability, and correct handling in all endpoints (NioEndpoint, Nio2Endpoint) to immediately process buffered pipelined data after sendfile completes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ca3ee9a1-fb2c-51af-9f49-b63c81fcaaa1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5650 is not present in Tomcat 10.1.33-tuxcare.3. The vulnerability affected Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 where HTTP/2 GOAWAY frame handling failed to close waiting streams, allowing thread exhaustion. The upstream fix (commits c909f01471 and 5496e193a8 from March 2017 by Mark Thomas) was already present in the Tomcat 10.1.33 release before TuxCare onboarded it. The fix ensures that when a GOAWAY frame is received, all associated streams are immediately reset and closed, releasing any waiting threads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:741c4fa2-ea50-5d08-a8bf-6637e4ff3a91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5664: Target Tomcat 10.1.33 is NOT AFFECTED. The vulnerability pattern is not present because the upstream Apache Tomcat fix was already included in version 10.1.33 release that TuxCare onboarded. Both DefaultServlet and WebdavServlet have the protective service() method override that forces doGet() for ERROR-dispatched requests, preventing unintended write operations (PUT/DELETE) on static error page resources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7f64a80a-6d38-5155-bddf-aacc6ba3f968",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.33 is not affected by CVE-2017-7674. The vulnerability concerned the CORS Filter not adding a Vary: Origin header, which permitted cache poisoning. The upstream fix (commit b94478d45b7e by Remy Maucherat, May 2017) was already present in Apache Tomcat 10.1.33 when it was released and onboarded by TuxCare. The target code contains ResponseUtil.addVaryFieldName(response, REQUES...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ad43c690-6a59-58ef-bcdb-9a977ff40afa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. Tomcat 10.1.33 is NOT affected by CVE-2017-7675. The vulnerability (HTTP/2 path parameter bypass allowing directory traversal) was fixed in upstream Apache Tomcat in May 2017 via commit cf181edc9a. The target version 10.1.33 was released years later and shipped with the fix already integrated. The fix code (setBytes() instead of setString() for URI processing) is present at java/org/apache/coyote/http2/Stream.java:404-409 with explicit Bug 61120 comment. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:02626258-8359-5daf-b137-db036d335df6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects Tomcat 7.0.0-7.0.93, 8.5.0-8.5.39, and 9.0.0.M1-9.0.0.17 due to XSS in the SSI printenv command when it echoes variables without HTML entity encoding. The target (Tomcat 10.1.33) is not affected because the upstream fix by Mark Thomas (commit 15fcd166ea, 2019-03-11) was already present when TuxCare onboarded version 10.1.33 in October 2026. The SSIPrintenv.java file uses S...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:05106382-48c5-580b-8391-18f7f640e31d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 is NOT present in Apache Tomcat 10.1.33. This CVE describes a regression in Transfer-Encoding header parsing that affected specific versions (9.0.28-9.0.30, 8.5.48-8.5.50, 7.0.98-7.0.99) where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The upstream fix (commit 3c295d913e) was already included in Apache Tomcat 10.1.33 before TuxC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a952a7a1-f49a-56cf-a7d7-39741dcb223c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-11996 is not present in Apache Tomcat 10.1.33-tuxcare.2. The vulnerability required a numeric loop that iterates through all potential stream IDs between maxActiveRemoteStreamId and a new large stream ID, causing CPU exhaustion when an attacker sends HTTP/2 requests with very large stream IDs (e.g., Integer.MAX_VALUE - 8). The vulnerable code pattern (for loop: `for (int i = maxActiveRemoteStreamId + 2; i < newMaxActiveRemoteStreamId; i += 2)`) does not exist in the target. The upstream Apache Tomcat 10.1.33 release already contained the fix (authored by markt@apache.org in May 2020, later refactored in Sept 2020) before TuxCare onboarded it in the first TuxCare commit 47a79a9e4c. The target uses `pruneClosedStreams()` which iterates only over actual streams in the collection (`for (AbstractNonZeroStream stream : streams.values())`), making stream ID magnitude irrelevant and preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:192a372e-e9ba-5ff8-a74a-038593f83eb5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13934 is NOT present in Apache Tomcat 10.1.33. The vulnerability (HTTP/1.1 processor leak during h2c direct connection upgrade causing OutOfMemoryError) was fixed in upstream Apache Tomcat commit c9167ae30f by Mark Thomas before the 10.1.33 release. The fix is present in the target codebase at AbstractProtocol.java:918-919, where the HTTP/1.1 processor is explicitly released via release(processor) before creating the HTTP/2 upgrade processor. This upstream fix shipped with the 10.1.33 release that TuxCare onboarded, so the vulnerable code pattern has never existed in this TuxCare branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:da09e3d3-a966-5227-b6b0-f4e0dab62bc8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13935 is NOT present in Apache Tomcat 10.1.33. The vulnerability concerns missing validation of the most significant bit in 64-bit WebSocket frame payload lengths, which could trigger denial of service. The fix (commit 1c1c77b0ef by Mark Thomas, June 29, 2020) was already included in the upstream Apache Tomcat 10.1.33 release before TuxCare onboarded it. The target code at WsFrameBase.java:247-256 contains the proper validation that rejects frames with negative payload lengths (MSB set), preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:37f59718-87cd-5cef-a31d-f1bbb3f4aadb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 affects Apache Tomcat's HTTP header parsing, allowing invalid headers with improper line terminators (bare CR without LF) or control characters to be accepted, enabling HTTP Request Smuggling. The target (Tomcat 10.1.33) contains the upstream fix from commit ae8c82eff96 \"Stricter header value parsing\" by Mark Thomas, which was already present in the Apache Tomcat 10.1.33 release t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e210c67a-0b7f-5ee8-9673-6b7c342b291d",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fe884f22-4495-56c0-b754-3e79e26165b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-30639 does not affect this target. The vulnerability involved a failure to reset the errorException field in the Request.recycle() method, causing all future requests handled by the same Request object to fail after a non-blocking I/O error. The fix (adding 'errorException = null;' in recycle()) was already present in Apache Tomcat 10.1.33 when TuxCare onboarded it. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0d0df808-53af-59a8-9ca8-27f54d3bc029",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat's JNDI Realm by allowing authentication using username variations containing special LDAP characters (e.g., ';', '*') due to missing input escaping. The target Apache Tomcat 10.1.33 is NOT AFFECTED because the upstream fix was already present in the release when TuxCare onboarded it. The fix (commit f4d9bdef53 by Mark Thomas, 2021-04-13) added two escaping m...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d1eef290-1c76-5772-9c8a-8fadd98eb989",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 10.1.33. All three vulnerability patterns have been fixed by upstream Apache commits that shipped in the 10.1.33 release: (1) Transfer-Encoding headers are now processed from HTTP/1.0 clients via !http09 check, (2) the \"identity\" encoding is rejected with 501 response, and (3) chunked encoding is enforced as the final encoding via contentDelimitati...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:be728871-81b5-5635-acb7-729d170e4da4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. Target Tomcat 10.1.33 is not affected by CVE-2021-41079. The vulnerability (infinite loops in OpenSSLEngine.unwrap() that could be triggered by specially crafted TLS packets) was fixed by upstream Apache in two commits from January and March 2021. Both fixes were already present in the upstream release when TuxCare onboarded version 10.1.33. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:def68877-3367-5bf9-88b5-a2206a37a46a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-42340 describes a memory leak where WebConnection objects used for metrics collection were not released for WebSocket connections. The target version 10.1.33 already contains the upstream fix (commit d5a6660cba) authored by remm@apache.org, which properly stores the WebConnection in init() and closes it in destroy(). This fix was included in the original Apache Tomcat 10.1.33 release before TuxCare onboarded it (first TuxCare commit: 47a79a9e4c \"Onboard version 10.1.33\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M1, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72), NVD (>= 8.5.60, < 8.5.72; >= 9.0.40, < 9.0.54; >= 10.0.1, < 10.0.12; = 10.0.0-milestone10; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5), cve.org (>= 10.0.0-M10, <= 10.0.11; = 10; >= 10.1.0-M1, <= 10.1.0-M5; = 10; >= 9.0.40, <= 9.0.53; = 9; >= 8.5.60, <= 8.5.71; = 8), Snyk (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M10, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5d96547b-f6f9-53e0-bf94-cd66cfeb8349",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 is NOT present in Apache Tomcat 10.1.33. The vulnerability (a concurrency bug allowing processor instance sharing between client connections) was fixed by upstream Apache in commit 17f177ee on March 29, 2022. This fix was already present in the upstream Tomcat 10.1.33 release when TuxCare onboarded it. The target code shows the fixed state: currentProcessor uses AtomicReference w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d0cd6333-1c62-578d-a7ec-dfa0dba0ec8a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23181 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-23181 is not present in target version 10.1.33. The TOCTOU vulnerability in FileStore.java was fixed in upstream Apache Tomcat commit 70da1aaa51e (2022-01-12) which shipped in Tomcat 10.1.0 (2022-09-23). The target version 10.1.33 (released 2024-11-07) already contains this fix from upstream. The vulnerable pattern (calling getCanonicalFile() during check but returning non-canonical file) is not present; the code correctly stores and reuses the canonical file reference.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e2abbaf1-fbac-540e-8746-00397af0f4f6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.33 is not affected by CVE-2022-25762. The vulnerability affects Tomcat 8.5.0-8.5.75 and 9.0.0.M1-9.0.20, but all required fixes were already present in the upstream Tomcat 10.1.33 release that TuxCare onboarded. The fixes include: removal of legacy double socket close, introduction of immutable CLOSED_NIO_CHANNEL sentinel objects, ClosedChannelException checks on read/write operations, and centralized socket lifecycle management. All fixes were authored by upstream Apache developers (remm@apache.org, markt@apache.org) in 2019 and shipped with the upstream 10.1.33 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6cbb0618-c59e-5c64-8960-042a7abd48f3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-29885 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only issue where Tomcat docs incorrectly stated that EncryptInterceptor provided complete protection for clustering over untrusted networks. The fix (correcting docs to clarify it lacks DoS protection) was applied upstream by Apache in commit 0fa7721f11 (May 2022) and shipped in the upstream 10.1.33 release. The target version 10.1.33 already contains the corrected documentation. No vulnerable documentation is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9716a092-46eb-5f71-8ec3-8c461dc63e83",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 XSS vulnerability is NOT present in Apache Tomcat 10.1.33. The fix was already included in the upstream release that TuxCare onboarded. All user-controllable data in the form authentication example (session attributes, Principal attributes, role parameter) is properly escaped with util.HTMLFilter.filter() before display, preventing XSS attacks. Fix commit d6251d1cfb by upstream a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ba56f833-f755-538f-9be1-15ddd0964fbc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) is not present in Tomcat 10.1.33. The fix preventing protocol-relative redirects was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable pattern never existed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dae2bfcf-ab0f-5f24-96a2-4f4310ac72f3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:247acaab-aecc-5760-b363-546091060fe1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.33. The vulnerability required improper parsing of HTTP trailer headers that could lead to request smuggling. The upstream Apache Tomcat project fixed this in October 2023 and subsequently refactored the code in April 2024 to use a centralized HttpHeaderParser class. Version 10.1.33, released November 2024, shipped with the fix already present. The r...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fbf2863c-104f-5c3b-b735-5e287c9bc630",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-54677 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8df7b1f5-6d57-5933-8791-3f01ad1cc4d2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7bd1d354-8be5-5dd7-bfbc-9e15e97396d6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55752 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8cb23f72-41b3-5940-bc08-adea861b575e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6c2fa3bb-2765-53e0-ad8d-13e309ebb814",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:53a42b65-a19c-5017-aad1-1e762bb43a3b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:593ec446-2c90-5ef8-b046-be1be2418242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e0fd7c5a-0d53-5dc2-8eab-906acf8bb725",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.33 is NOT affected by CVE-2026-29129. The vulnerability was introduced in a later version (between 10.1.33 and 10.1.51) when TLS 1.3 cipher suite support was added in January 2026. The target version uses a simpler code path that already preserves cipher order via LinkedHashSet, and lacks the HashSet-based cipher merging logic that caused the order preservation bug in version...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b02d4fc1-bb53-5da0-95eb-f8c55175d23f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a774b3af-8bfd-5cf0-9407-e8b9a9e33fd3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f02bf1a7-bd41-5c35-bb7e-76f2e57f0206",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.33 is NOT AFFECTED by CVE-2026-32990. The vulnerable code pattern (the checkSni method with improper protocol hostname normalization) does not exist in this version. The vulnerability was introduced in later versions (10.1.50-10.1.52) when the strict SNI validation feature was added via CVE-2025-66614's fix, and the incomplete normalization in that new code created CVE-2026-...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:cd22a154-456c-507e-871a-b62d9d233815",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:398bcfb7-49af-54de-bdc8-326430cb332d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34486 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:958f6167-2748-50b6-aadf-32a77affd16d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3a5f2bfc-f032-5f4b-b441-9cafad9cda5e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:269feb86-b6f3-5146-9791-11315ab540a3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9062c016-4f9b-5134-b237-bfe3a0d4abb8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f4b49c0c-796e-5a65-a0aa-7590a27a86fc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:709d65fc-cd8a-5095-8457-42b7ebce86c0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6d2bf4d9-8232-5ab3-8e92-2dd3a6099cb7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d833ca26-22aa-5e20-8496-b7f5e9786640",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fd22c205-8dea-5fcf-bce4-ce3a3b9703be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ca2a9d74-3c10-5b51-942f-a366f13635e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a8abadfe-4267-53e0-90c6-bac1a4f959a9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bb2f69e3-1f06-545d-9765-279273fbff78",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:af44444f-7921-5ef2-9954-ad349b65dea2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:569d9d9a-7412-5c56-bf99-45650d30d8f8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5aafd42d-3909-5fc1-896d-3b4ea30537b6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bae8df8a-9709-504b-b59b-4f8bc77c8f5f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c783434f-2efd-5aeb-a222-cc5c555f94c6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.33-tuxcare.3 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.3"
    }
  ]
}