{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4a1744e2-5a46-5f39-a828-302d69e3d395",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11",
      "version": "10.1.42-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.42"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:33a1af83-cb73-5d97-a41e-28aab20cedf7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is NOT present in Tomcat 10.1.42-tuxcare.11. The XSS vulnerability in the host-manager's /html/add endpoint was fixed by upstream Apache in 2008 (commit 49c71fc59c) and this fix was already present in the upstream release 10.1.42 when TuxCare onboarded it. The current code properly HTML-escapes the name parameter using Escape.htmlElementContent() before reflecting it in HTML outpu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:f88d7a3d-fa1b-5616-8014-42e154ae8ed1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2013-4590 (XXE vulnerability in XML parsing). The upstream vendor (Apache) fixed this vulnerability in December 2013 by implementing a blockExternal defense mechanism in the XML entity resolver that throws FileNotFoundException for external entities not in a predefined whitelist. This fix was already present in the Apache Tomcat 10.1.42 release that ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:f63334cf-ed2e-531a-bf41-a7256721bc55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.42) is NOT vulnerable to CVE-2015-5174. The directory traversal vulnerability was fixed in the upstream codebase through commits in 2015-2016, both authored by Mark Thomas (markt@apache.org) from Apache. The fix was already present in the upstream release when TuxCare onboarded version 10.1.42. The current implementation uses a refactored approach (adde...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d827ce1f-70e5-5a3a-9f8e-10eb8a81bed4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). Version 10.1.42 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-jrcp-c39h-r29x (affected up to 9.0.0.M2), NVD (affected up to 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:74fd03b7-015f-54bb-b2a3-ed8619e774fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 concerns StatusManagerServlet not being listed in RestrictedServlets.properties, allowing remote authenticated users to bypass SecurityManager restrictions and read arbitrary HTTP requests including session IDs. The target repository (Apache Tomcat 10.1.42-tuxcare.11) already contains the fix: StatusManagerServlet is properly listed in RestrictedServlets.properties (line 19), and ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:634d3ebe-2b6c-5388-ae5e-7f336def5584",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 10.1.42. The fix (commit 86b2e436099cb48f30dad950175c5beeeb763756 by Apache upstream author markt@apache.org) was already included in the upstream release before TuxCare onboarded this version. All affected Realm implementations (RealmBase, DataSourceRealm, MemoryRealm) contain the mitigation: `getCredentialHandler().mutate(cred...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:1fe6ed0c-61bd-5eef-8a50-d90b62a8364e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763: The target Apache Tomcat 10.1.42-tuxcare.11 is NOT AFFECTED. The vulnerability in ResourceLinkFactory.setGlobalContext() allowed unauthorized web applications to bypass SecurityManager restrictions and access arbitrary application data. The vendor patch added a RuntimePermission check before allowing modification of the global JNDI context. This fix is present in the target at Re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9aa4c369-3488-56af-8d11-a06d5526aafd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED by CVE-2016-6794. The vulnerability, which allowed web applications to bypass SecurityManager restrictions and read system properties they shouldn't access, was already fixed by Apache upstream before TuxCare onboarded version 10.1.42. The fix includes: (1) PermissionCheck interface for permission validation, (2) WebappCla...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:2d0dfebd-6ef8-577a-bf6c-2e28ff523aaa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.42 is NOT affected by CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP servlet configuration parameters (engineOptionsClass and scratchdir). The upstream fix by Mark Thomas (commit f603f2f4595, August 2016) was already present in all Tomcat 10.x releases. The target contains the complete defense: both JspServlet.java and EmbeddedServletOptions.java properly check Constants.IS_SECURITY_ENABLED and ignore the vulnerable parameters when SecurityManager is active. This is an upstream fix that shipped with the original Tomcat 10.x releases, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a7f84fa7-dc6c-5751-8cc9-dffabd6456fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. The target Tomcat 10.1.42 is not affected by CVE-2016-6797. The vulnerability (unrestricted web application access to global JNDI resources) was fixed in upstream commit 2859ac3eae by Mark Thomas on 2016-08-22, years before Tomcat 10.1.42 was released. The fix was already present in the upstream release 10.1.42 that TuxCare onboarded on 2026-03-11. The complete defense infrastructure (registration tracking, validation checks) is present and functional in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a924b769-c180-582f-b098-8699e027f6d0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.42-tuxcare.11 is NOT affected by CVE-2016-6817. The vulnerable HTTP/2 header parser infinite loop pattern is not present in the target. The upstream vendor (Apache) fixed this vulnerability in October 2016 (commit 079372fc7b), and this fix was already present in all Tomcat 10.1.x releases including 10.1.0 (2022) and the target version 10.1.42. The fix adds dynamic buffer expansion logic that prevents the infinite loop condition when processing HTTP/2 headers larger than the available buffer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6a18911e-6273-5899-b07b-bb3e4bcb279f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15, causing information disclosure where HTTP request data can leak between requests due to improper ByteBuffer state management in Http11InputBuffer.java's nextRequest() method. The target (Tomcat 10.1.42) is NOT affected because the fix was already present in the upstream Apache release when TuxCare onboarded this version. The fix was introduced by Apache developer Mark Thomas on 2016-12-14 in commit 98466fdc1e6, which predates the TuxCare onboarding commit (39e58930c \"Setup 10.1.42\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ffa4ef96-6a46-5671-9d5e-efb89279bd75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2017-5647 is not present in Tomcat 10.1.42. The vulnerability affected handling of HTTP pipelined requests during sendfile operations, causing pipelined requests to be lost and responses to be sent for the wrong requests. The upstream fix (commit 864aa1199a by Mark Thomas, March 27, 2017) was already included in the upstream release 10.1.42 before TuxCare onboarded it. The fix introduces SendfileKeepAliveState enum with three states (NONE, PIPELINED, OPEN) and checks available() to detect pipelined data in the buffer, ensuring pipelined requests are processed immediately rather than being lost. All fix components are present and active in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:330927f7-1971-593e-adc2-8d9170f58223",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. Target Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2017-5650. The vulnerability involved HTTP/2 GOAWAY frames not closing associated streams, causing thread exhaustion. The upstream Apache fix (commit c909f01471 by markt@apache.org, March 24, 2017) was already present in the upstream 10.1.42 release that TuxCare onboarded. The fix ensures goaway() calls close(), which iterates through all streams and calls receiveReset() to release threads, directly addressing the vulnerability's attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:75eafce9-9608-5291-a33b-dfd56f2986ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Apache Tomcat 10.1.42-tuxcare.11. The vulnerability concerned DefaultServlet and WebdavServlet not treating ERROR-dispatched requests as GET requests, potentially allowing HTTP methods like PUT/DELETE to modify or delete static error pages. The upstream Apache fix (commit 7d93527254d9e9371b342800617f20d13c8b85ad by Mark Thomas) was already present in the upstream Tomcat 10.1.42 release before TuxCare onboarded it. Both DefaultServlet and WebdavServlet contain the protective service() method override that checks for DispatcherType.ERROR and forces processing through doGet(), preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b0b81462-d719-5361-8b87-41f1a8aa3238",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674: The target Apache Tomcat 10.1.42-tuxcare.11 is NOT AFFECTED. The vulnerability (missing Vary: Origin header in CORS responses) was fixed by the upstream Apache Tomcat project in commit e76f746e2d7 (2018-07-09) by Mark Thomas, which improved upon the original BZ61101 fix. This fix was already present in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The target ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:62ebf829-7d08-56e4-8f07-60e23e50b7bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. The target Apache Tomcat 10.1.42 is NOT affected by CVE-2017-7675. The vulnerability, which allowed HTTP/2 requests to bypass security constraints by ignoring path parameters, was fixed in the upstream Apache Tomcat release before TuxCare onboarded version 10.1.42. The fix (Bug 61120) is present in java/org/apache/coyote/http2/Stream.java at lines 404-409, where the code converts the URI to bytes before setting it on the request object, ensuring path parameters are correctly processed and security checks are applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ea8519a3-5942-5cfb-9bc2-69baa4b5a28f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 (SSI printenv XSS) is not present in Tomcat 10.1.42. The fix (commit 15fcd166ea by Mark Thomas) was already included in the upstream Apache Tomcat 10.1.42 release before TuxCare onboarded this version. The vulnerable pattern (unencoded variable output) is absent because SSIPrintenv.java:41 uses `getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)`, which applies HTML entit...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:21f6ff1c-c13c-5f18-a60c-5d27c5932225",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 where a regression caused invalid Transfer-Encoding headers to be processed instead of rejected, enabling HTTP Request Smuggling. The target version 10.1.42 is not affected because the upstream fix (commit 3c295d913e1, Dec 2019) was included in Tomcat 10.1.0 and all later releases. The vulnerable code ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9cb94e8f-552c-5cc7-90fc-27e9002e1b9e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2020-11996 is NOT present in Tomcat 10.1.42. The vulnerability affected Tomcat 10.0.0-M1 to 10.0.0-M5 (and 9.0.x/8.5.x series) due to a performance issue in the closeIdleStreams() method that used numeric-range iteration. When an attacker sent HTTP/2 requests with very large stream IDs (e.g., Integer.MAX_VALUE - 8), the server would iterate billions of times, causing CPU exhaustion. The fix replaced numeric-range iteration with iteration over the actual streams collection. This fix was committed upstream by Mark Thomas (markt@apache.org) on 2020-05-22 and shipped in Tomcat 10.0.0-M6. The Tomcat 10.1.x series, first released in June 2021, inherited this fix. The target (10.1.42) uses pruneClosedStreams() with safe iteration over streams.values(), not the vulnerable closeIdleStreams() pattern. The fix was already in the upstream release when TuxCare onboarded version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cedb47ae-1e07-5ee9-9d23-1b64b08af9dc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. The target (Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED by CVE-2020-13934. The vulnerability involves a resource leak where HTTP/1.1 processors were not released after upgrading to HTTP/2 via h2c direct connections, leading to potential OutOfMemoryError. The fix (commit c9167ae30f by Mark Thomas, dated 2020-06-26) was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded on 2026-03-11. The defensive code is present at AbstractProtocol.java:916-917, where the HTTP/1.1 processor is properly released before creating the HTTP/2 upgrade processor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:79c66163-4827-546a-b969-c6ac8763bf21",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. Target Apache Tomcat 10.1.42 is NOT AFFECTED by CVE-2020-13935. The vulnerability required validation of WebSocket frame payload length when the MSB of a 64-bit length field is set. The fix (adding validation that payloadLength >= 0 to reject negative values caused by MSB=1) was committed by upstream Apache in commit 1c1c77b0ef on June 29, 2020, and shipped in Tomcat 10.0.0-M7. This predates the target's 10.1.42 release, so the vulnerable code pattern has never been present in this version. The fix is confirmed present at WsFrameBase.java:248-254.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:883cdae4-b1b2-506f-960e-20c9d75376ca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED by CVE-2020-1935. The vulnerability, which involved improper HTTP header parsing that allowed malformed CRLF sequences and control characters in header values (potentially enabling HTTP request smuggling), was fixed by upstream Apache Tomcat in commit ae8c82eff96990878e79691819ae941538ee62fd on January 6, 2020. This fix wa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d15c396b-180c-5b0f-b76f-02f732a3607e",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.42-tuxcare.11."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:fc4ee1f0-d269-5926-a09b-506571d234ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2021-30639 affects Tomcat 10.0.3-10.0.4, 9.0.44, and 8.5.64. The target version 10.1.42 is not affected because the upstream fix (adding `errorException = null;` in the recycle() method) was already present in the upstream release when TuxCare onboarded this version. The fix was committed by Apache on March 24, 2021, and version 10.1.42 (onboarded in 2026) shipped with this fix from the beginning.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dbb74be0-02a0-5672-b796-324cbad0d2d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat's JNDI Realm due to missing LDAP special character escaping in usernames. The target (Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED because the vulnerability was fixed in upstream Tomcat before the 10.1.42 release. The fix (commit f4d9bdef53 by markt@apache.org) adds RFC 4514 attribute value escaping and RFC 2254 filter escaping methods that are properly applie...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:12381f92-2600-53ea-a771-20cd6b970e63",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 10.1.42-tuxcare.11. All three vulnerability patterns have been fixed by upstream Apache Tomcat before the 10.1.42 release: (1) Transfer-Encoding headers are now processed from HTTP/1.0 clients (not just HTTP/1.1), (2) the \"identity\" encoding is rejected with a 501 response, and (3) requests with chunked encoding not as the final encoding are rejected with...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b95496eb-7565-5b78-9a43-364993a51d7f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2021-41079 is not present in Tomcat 10.1.42. The vulnerability involved two infinite loop conditions in OpenSSLEngine.unwrap() when processing TLS packets with NIO+OpenSSL. Both fixes were authored by upstream Apache developers (remm@apache.org, markt@apache.org) and were already present in the Tomcat 10.1.42 release before TuxCare onboarded it. Fix 1: Added check for idx==endOffset condition (commit 5ee9947fee). Fix 2: Changed bytesRead==0 from break to exception throw (commits 34115fb3c83, 54c6ac7ee1c). All fix commits are ancestors of the first TuxCare commit (39e58930c6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e7c0e1e8-4a3c-58bb-a49d-7de1baeed695",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.42 is NOT affected by CVE-2021-42340. The vulnerability (memory leak from unreleased WebConnection objects in WebSocket upgrade handlers) was fixed by upstream Apache in commit d5a6660cba7f51589468937bf3bbad4db7810371 (\"Close WebConnection\") by remm@apache.org on September 27, 2021. This fix was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it. The CVE affected versions 10.1.0-M1 to 10.1.0-M5; version 10.1.42 (released after the fix) contains the corrected code that properly stores and releases the WebConnection reference in the WsHttpUpgradeHandler.destroy() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M1, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72), NVD (>= 8.5.60, < 8.5.72; >= 9.0.40, < 9.0.54; >= 10.0.1, < 10.0.12; = 10.0.0-milestone10; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5), cve.org (>= 10.0.0-M10, <= 10.0.11; = 10; >= 10.1.0-M1, <= 10.1.0-M5; = 10; >= 9.0.40, <= 9.0.53; = 9; >= 8.5.60, <= 8.5.71; = 8), Snyk (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M10, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6d6c49d8-d366-57ae-92dc-ebdce85918ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability, which allowed client connections to share an Http11Processor instance due to non-atomic processor ownership transfer, was fixed by upstream Apache Tomcat (commit 170e0f79 by Mark Thomas) and shipped in the Tomcat 10.1.42 release. The target contains the complete fix: AtomicReference for currentProcessor storage, atom...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6900b38b-2a13-5ff2-a3f8-d69db91c7bfa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23181 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2022-23181 is NOT present in Apache Tomcat 10.1.42-tuxcare.11. The Time-Of-Check-Time-Of-Use (TOCTOU) vulnerability in FileStore.java was fixed by upstream Apache in commit 70da1aaa51e0f9d088438e9d958812a144e12754 (January 12, 2022) by Mark Thomas. This fix was already included in the Apache Tomcat 10.1.42 release, before TuxCare onboarded this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ab7de4ec-517a-5eca-9b18-443117dbf573",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2022-25762 is not present in the target. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The target contains the complete defense implementation: CLOSED_NIO_CHANNEL/CLOSED_NIO2_CHANNEL immutable placeholders, ClosedChannelException checks in I/O operations, and socket-to-wrapper refactoring that prevents use-after-close vulnerabilities. All fix commits (c2d6278b33, 339b40bc07, 7046644bf3, 204c4fa6c0) are authored by upstream Apache committers and are ancestors of the first TuxCare commit, confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:94f8064b-f43d-578d-bac7-14d223ee4e6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-29885 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation vulnerability where Tomcat incorrectly stated that EncryptInterceptor enabled safe clustering on untrusted networks. The target (Tomcat 10.1.42-tuxcare.11) contains the CORRECTED documentation that properly warns users EncryptInterceptor \"does not protect against all risks associated with running a Tomcat cluster on an untrusted network, particularly DoS attacks.\" The fix was applied upstream by Mark Thomas (markt@apache.org) in commit 0fa7721f11 and was included in the upstream 10.1.42 release that TuxCare onboarded. The vulnerable documentation pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:519262a6-0801-552f-960e-5609b8e1cded",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 is not present in Tomcat 10.1.42-tuxcare.11. The XSS vulnerability in the Form authentication example has been fixed by upstream Apache (commit d6251d1cfb by Mark Thomas on 2022-06-23). The fix was already present in the upstream release when TuxCare onboarded version 10.1.42 on 2026-03-11. All user-controlled data (principal attributes, session attributes, role parameters) are n...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d1c5192e-03bd-5951-aeee-051ff22336f2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in target version 10.1.42. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The defense code (lines 766-769 in FormAuthenticator.java) strips consecutive leading slashes from saved request URLs, preventing protocol-relative redirect interpretation (e....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d3fadf07-57c7-55cc-84a6-3618865c8807",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:98e89452-7328-5fd1-9d56-a7f1586cea64",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which validates that trailer header names contain only token characters and values do not contain control characters (except HT/tab), was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:eb0d5967-55c2-55f6-82fa-e9843c88efd3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-54677 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2024-54677. All fixes for the uncontrolled resource consumption vulnerability in the examples webapp were already present in the upstream Apache Tomcat 10.1.42 release, which predates the TuxCare onboarding of this version. The vulnerable patterns (unbounded session attribute growth, unbounded shopping cart items) are not presen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:79a8cb37-bf07-594b-922b-211609cda57f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49124 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT vulnerable to CVE-2025-49124. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and this fix was already present when TuxCare onboarded the 10.1.42 release. All three icacls.exe invocations in the Windows installer script (res/install-win/tomcat.nsi at lines 382, 395, 408) use the full system path ($SYSDIR\\icacls) instead of relying on PATH search, preventing untrusted search path attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e98e6c9d-cba3-564b-80d2-4161910fbe1d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a183b8f4-5070-5deb-bd97-a96c02f32e01",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ae36a12b-c178-563e-8d90-48f9b7bd3643",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dbb8bc46-7e6b-56b3-b764-403fe5bf6fc5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ba374508-3468-599a-b28c-b56dce7d3628",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:fdf57676-95c8-54d5-b23c-6e0cfd7b0268",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 10.1.42 is NOT affected by CVE-2026-29129. The vulnerability (cipher preference order not preserved) was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added using HashSet, which doesn't preserve order. Version 10.1.42 predates this change and uses LinkedHashSet throughout the cipher handling pipeline, correctly preserving the configured cipher preference order. The ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4729e765-0cfb-5733-9c2f-9b37fe4ca3c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b43443b4-5bfd-54e0-a024-95523f0b484d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d8f3cdad-18b2-5875-8fc9-dfb279885d4a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:eb4b5803-ae9e-5c04-8bdc-e7c7a8a1e499",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:73701d8b-9097-5ebd-b8ce-921eac66cfa4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34486 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4766f93a-bd06-5175-bc28-a4f1e07eff57",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b9dfddd6-9427-5fe2-9d7c-1d79d4f84da2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ea1a82a8-53e5-59e4-bde6-0eb1d788e7c9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:7011a896-ac6c-5708-9967-9f745934b2b6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:adc95bff-48d4-5782-b4a8-e033b10d6697",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e5b00013-eaef-5e4e-ad1d-c6bea0c8d6c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:83ab9fc3-41c5-553e-932f-b16aa1159fe0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:60cc3ce6-441e-590b-8051-9a31b4b1050e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9f0e8175-e42f-5dc9-8e0c-269903ae09ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4ae87745-01ff-530e-8e4f-c79d13be69a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0742cb8e-570a-5ccc-aa88-b5429529a995",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9f7d5210-888f-5289-94a0-f5d2aad92307",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:98981312-baff-5384-83bc-a13ae83fafc7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:3d56a939-b7dc-53ec-a90c-772c4578f1b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:25cb8341-84f6-5093-8c21-af5438df23ed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:885aa03d-44e9-51e1-b7d1-f853b9ef4823",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:152762aa-8528-5936-8161-c8684cbe2c74",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.11"
    }
  ]
}