{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89ce56be-c82b-5158-98c2-6ccf24e6ee4d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3", "version": "10.1.50-tuxcare.3", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.50", "type": "library", "group": "org.apache.tomcat", "version": "10.1.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:863296d4-a66a-51df-aa01-09c0683d2f99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2008-1947 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16 where the name parameter in the host-manager/html/add endpoint was rendered without HTML escaping. The target (Tomcat 10.1.50) is not affected because the upstream Apache Tomcat project fixed this vulnerability years ago. The fix\u2014HTML escaping via Escape.htmlElementContent()\u2014was introduced in commit 17fd...", "justification": "code_not_present" } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:b095ea75-c106-5861-b519-2320773e9f97", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 The target (Apache Tomcat 10.1.50-tuxcare.3) is not affected by CVE-2013-4590. The vulnerability affected versions before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10. The XXE defense (blocking external entity resolution via LocalResolver with blockExternal=true) is present in the target and was introduced by upstream Apache commit 05c84ff830 authored by markt@apache.org, which predates...", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:3861a8ae-65f6-5342-b70b-dadb6b835bbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target is not affected by CVE-2015-5174. The vulnerable pattern (checking for `/..` and `/.` BEFORE normalization) is not present in Tomcat 10.1.50. An upstream fix was introduced in April 2016 (commit 47ecd0d0f9) that uses an alternative defense mechanism: adding a trailing slash to paths ending with `/.` or `/..` before normalization, ensuring they become `/./'` or `/../` and are caught by th...", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:e79a1702-bccc-534c-be01-148785514cb2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5346 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 10.1.50 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-jrcp-c39h-r29x (affected up to 9.0.0.M2), NVD (affected up to 9.0.0-milestone1).", "justification": "code_not_present" } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:45e7fa36-db9d-5391-89e1-10d51451143f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is NOT present in this target. The vulnerability required StatusManagerServlet to be missing from the restricted servlets list, allowing unprivileged web applications to load it and access privileged HTTP request data (including session IDs). The fix commit c8601f802d (authored by Apache maintainer Mark Thomas) added StatusManagerServlet to RestrictedServlets.properties, and this ...", "justification": "code_not_present" } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:4340b070-9633-53c5-855d-039103dfe128", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.50 is not affected by CVE-2016-0762. The timing attack vulnerability in Realm implementations was fixed by the upstream Apache Tomcat project before version 10.1.50 was released. The fix, which ensures password processing occurs even for non-existent usernames (via getCredentialHandler().mutate(credentials)), is present in all Realm implementations (RealmBase, DataSourceRealm...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:c3c321d4-13e7-518b-a81e-7f17cdd83f61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not present in Apache Tomcat 10.1.50-tuxcare.3. The vulnerability concerned the setGlobalContext method in ResourceLinkFactory.java lacking authorization checks, allowing malicious web applications to bypass SecurityManager restrictions. The fix (SecurityManager permission check requiring RuntimePermission) was applied by Apache upstream in commit 76ebc9007567c8326217dd94844540...", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:a8b17427-2182-51ab-af5c-c7d641585179", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 fix is already present in Apache Tomcat 10.1.50. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the Digester's system property replacement feature. The fix was implemented by upstream Apache Tomcat developer Mark Thomas in July 2016 and shipped with the upstream Tomcat 10.1.50 release. The fix introduces a Permi...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:26ca6889-3c5f-50e8-88e5-814c0a4cc514", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. Target Tomcat 10.1.50 is not affected by CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions via JSP configuration parameters. The upstream fix (commit f603f2f459 by Mark Thomas, 2016-08-30) added checks to ignore `engineOptionsClass` and `scratchdir` parameters when SecurityManager is enabled. This fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded on 2026-09-20, so the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:226522ae-01f7-56fa-a796-9fae344b2e56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Apache Tomcat 10.1.50. The upstream fix by Mark Thomas (commit 2859ac3eae) was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The vulnerable pattern (unrestricted JNDI global resource access) has been eliminated by the registration/validation system implemented in ResourceLinkFactory and NamingContextListener.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:f0505349-e5c9-5d28-8f62-2a898d6570d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6817 does not affect Apache Tomcat 10.1.50-tuxcare.3. The vulnerability involved an infinite loop in HTTP/2 header parsing when headers exceeded the buffer capacity. The fix (adding dynamic buffer expansion) was implemented by Apache upstream in commit 079372fc7b by Mark Thomas and was already present in Tomcat 10.1.50 when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:13846c3f-bd19-55eb-9a77-8ee7342b7408", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-8747 is not present in Apache Tomcat 10.1.50-tuxcare.3. The vulnerability involved improper ByteBuffer position/limit management in Http11InputBuffer.nextRequest() that could cause cross-request information disclosure. The fix (adding byteBuffer.flip() after compact()) was applied by upstream Apache developer Mark Thomas in commit 452c8094a6 (Dec 2016) and was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The target code at /var/lib/vc-scratch/tmpqzthfoel/repo/java/org/apache/coyote/http11/Http11InputBuffer.java lines 287-296 contains the proper fix. Vulnerable pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:79f9c38d-f832-5e4a-bb10-24e7c7c7cf09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5647 is not present in Tomcat 10.1.50. The vulnerability (pipelined HTTP requests lost during sendfile processing, causing response mismatch) was fixed in the upstream Apache Tomcat project in March 2017. The fix was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:cf314b9b-bf6d-5d07-bfb5-11b6c7aa7d16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.50 is not affected by CVE-2017-5650. The vulnerability, which allowed malicious clients to exhaust processing threads by sending HTTP/2 GOAWAY frames without properly closing associated streams, was fixed by Apache upstream in March 2017 (commit c909f01471). The fix\u2014which ensures that goaway() calls close() and close() resets all streams\u2014was already present in the Tomcat 10.1.50 release that TuxCare onboarded. Both required code changes are present in the target at lines 1849 (goaway\u2192close call) and 1316 (close\u2192receiveReset loop).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:0a413423-45f8-5a27-b871-735b6fc29475", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Tomcat 10.1.50. The vulnerability affected Tomcat versions 7.0.0-7.0.77, 8.0.0.RC1-8.0.43, 8.5.0-8.5.14, and 9.0.0.M1-9.0.0.M20. The fix was applied to the Apache Tomcat upstream in May 2017 (commit 7d93527) and shipped in subsequent releases. Tomcat 10.1.50 includes this upstream fix, which adds a service() method override in DefaultServlet and WebdavServlet to force doGet() processing when the dispatcher type is ERROR, preventing static error pages from being modified or deleted via non-GET methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:c2812910-0be2-520e-a7aa-e613d78212f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is NOT present in Apache Tomcat 10.1.50. The vulnerability (CORS Filter missing Vary: Origin header causing cache poisoning) was fixed by upstream Apache developers in 2017-2018 and the fix was already present in the upstream 10.1.50 release that TuxCare onboarded. The target code properly adds Vary: Origin headers via ResponseUtil.addVaryFieldName() in both CORS and non-CORS requ...", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:1588c861-ef43-5cd8-8ada-f7f940c1d2b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in Apache Tomcat 10.1.50-tuxcare.3. The vulnerability (HTTP/2 path parameter stripping enabling security constraint bypass) was fixed in upstream Apache Tomcat by commit cf181edc9a8c239cde704cffc3c503425bdcae2b (Mark Thomas, May 2017), which changed Stream.java to use setBytes() instead of setString() for URI processing. This fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The target code correctly processes path parameters like ;jsessionid= in HTTP/2 requests, preventing the security bypass. No vulnerable code pattern (setString() calls that strip path parameters) exists in the HTTP/2 implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:a9a51570-e39e-525f-b0eb-cbd6baa75024", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 10.1.50. The vulnerability concerned the SSI printenv command echoing environment variable values without HTML escaping, enabling XSS attacks. The upstream fix (commit 15fcd166ea by Mark Thomas, 2019-04-09) was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The current code at SSIPrintenv.java:38 properly applies HTML entit...", "justification": "code_not_present" } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:f4c50334-1d3c-5758-a5c9-4daa5b33521e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-17569 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.50 is not affected by CVE-2019-17569. The vulnerability involved a regression in Transfer-Encoding header parsing (introduced in 7.0.98, 8.5.48, 9.0.28) where invalid tokens were silently ignored instead of rejected, potentially enabling HTTP Request Smuggling. The fix was authored by upstream Apache Tomcat (Mark Thomas, commit 3c295d913e on 2019-12-17) and shipped with the u...", "justification": "code_not_present" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:2b1259c3-03e7-523f-acb6-d1060a9b0fb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11996 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-11996 describes a DoS vulnerability in Apache Tomcat's HTTP/2 implementation where specially crafted requests with large stream IDs cause high CPU usage. The vulnerable code pattern (inefficient O(n) iteration in closeIdleStreams method) does not exist in target version 10.1.50. The entire implicit idle stream closing mechanism was removed in upstream commit 043d6581b8 (Sept 2024) because \"Tomcat never creates streams in the idle state without immediately transitioning them to open.\" This architectural change shipped in the upstream release that TuxCare onboarded, eliminating the vulnerability pattern entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:3e66eb7f-324c-5c65-b007-d4d5c8c96ecb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13934: The target Apache Tomcat 10.1.50 is NOT AFFECTED. The vulnerability (HTTP/1.1 processor leak during h2c direct connections leading to OutOfMemoryException) has been fixed by upstream commit c9167ae30f. This fix was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix adds a `release(processor)` call at line 917 of AbstractProtocol.java before creating the HTTP/2 upgrade processor, preventing processor object accumulation. Since the fix was authored by markt@apache.org (not TuxCare/CloudLinux) and was part of the upstream release, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).", "justification": "code_not_present" } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:67a985c5-1bba-5f67-9ff7-9df157951d68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13935 is not present in Tomcat 10.1.50. The vulnerability (infinite loop from WebSocket frames with MSB-set payload lengths) was fixed by upstream Apache in commit 1c1c77b0ef on June 29, 2020. This fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded in September 2026. The required validation (payloadLength < 0 check) exists at WsFrameBase.java:254-257, rejecting frames with negative payload lengths before they can trigger an infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).", "justification": "code_not_present" } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:a1c6da52-e1a7-53ef-83f8-50a26fd93e3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1935 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target Tomcat 10.1.50 is not affected by CVE-2020-1935. The vulnerability (improper HTTP header parsing allowing request smuggling via malformed CRLF sequences and control characters) was fixed in upstream Tomcat 9.0.31 (January 2020). The fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The vulnerable pattern does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:3280d6f2-bfc3-5b6f-a86f-308057b2fe47", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.50-tuxcare.3." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:ef77ad72-b1a4-5756-9fc2-97519ec762cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-30639 affects Apache Tomcat versions 10.0.3-10.0.4, 9.0.44, and 8.5.64 due to a regression where the errorException field in Request objects was not reset during recycling, causing persistent error state across requests and enabling DoS attacks. The target (Tomcat 10.1.50) is NOT AFFECTED because the upstream fix (commit b59099e4ca) was already included in the 10.1.50 release. The fix adds \"errorException = null;\" in the recycle() method at line 855 of Request.java, properly clearing error state between requests. This is an upstream fix by Mark Thomas (markt@apache.org), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:54980068-41c5-54e3-9193-c55f2c393579", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30640 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat's JNDI Realm, allowing authentication bypass via usernames containing LDAP special characters (`;`, `*`, etc.) that were not properly escaped. When unescaped, \"user;\" is parsed as \"user\" (semicolon acts as DN component separator) and \"user*\" matches multiple users (wildcard in search filters). The target Apache Tomcat 10.1.50-tuxcare.2 is NOT AFFECTED becaus...", "justification": "code_not_present" } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:ba9e43ab-0c09-59b7-b6ec-6201c82c98e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 is not affected by CVE-2021-33037. All three fixes from the upstream Apache Tomcat project were already present in the upstream 10.1.50 release when TuxCare onboarded it in October 2026. The CVE affected Tomcat 10.0.0-M1 to 10.0.6, and version 10.1.50 was released after the vulnerability was fixed upstream in May-June 2021. No TuxCare backport was needed for this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:618a71f1-0b32-5477-ad0a-69ee4defba04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41079 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.50 is not affected by CVE-2021-41079. The vulnerability involves an infinite loop in OpenSSLEngine.unwrap() when processing malformed TLS packets with NIO+OpenSSL or NIO2+OpenSSL. Both required fixes (idx==endOffset check and bytesRead==0 check) were applied by Apache upstream in versions 10.0.1 and 10.0.10, well before the target version 10.1.50. The fixes were already present in the upstream release when TuxCare onboarded version 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).", "justification": "code_not_present" } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:255fac29-f5a2-53e8-bb3c-d53ad057fb8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-42340 describes a memory leak where WebConnection objects were not released when WebSocket connections closed. The target Apache Tomcat 10.1.50 is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The fix commit d5a6660cba7f51589468937bf3bbad4db7810371 by upstream Apache committer remm@apache.org properly stores the WebConnection reference in init() and closes/nulls it in destroy(), preventing the memory leak. This fix was shipped in upstream Tomcat 10.1.50 before TuxCare's onboarding commit 8f04542b9a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M1, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72), NVD (>= 8.5.60, < 8.5.72; >= 9.0.40, < 9.0.54; >= 10.0.1, < 10.0.12; = 10.0.0-milestone10; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5), cve.org (>= 10.0.0-M10, <= 10.0.11; = 10; >= 10.1.0-M1, <= 10.1.0-M5; = 10; >= 9.0.40, <= 9.0.53; = 9; >= 8.5.60, <= 8.5.71; = 8), Snyk (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M10, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72).", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:947f4165-e667-50ba-8c2d-fdb8749f6393", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 already contains the upstream fix for CVE-2021-43980. The vulnerability affected versions 10.1.0 to 10.1.0-M12, and the fix (commit 17f177eeb7df5938f67ef9ea580411b120195f13 by Mark Thomas) was applied starting from 10.1.0-M13. Version 10.1.50 is well beyond the affected range and the fix was already present in the upstream release when TuxCare onboarded it. The code uses ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:b8a082bf-021f-54af-9b24-01bdce4fb4a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23181 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-23181 (TOCTOU vulnerability in FileStore session persistence) is NOT present in target version 10.1.50. The upstream Apache Tomcat fix by Mark Thomas (commit 70da1aaa, dated 2022-01-12) was already included in the Apache Tomcat 10.1.50 release before TuxCare onboarded it. The vulnerable pattern (checking canonical path but returning non-canonical file object) is absent from the target code at java/org/apache/catalina/session/FileStore.java:314-331. The method correctly stores the canonical file in a variable and returns that same canonical file, eliminating the time-of-check-time-of-use gap.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).", "justification": "code_not_present" } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:ba886fc5-051d-5924-b0eb-c520acff78ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25762 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-25762 is NOT present in Tomcat 10.1.50. All four upstream fix commits (e2d5a040, 7046644b, 339b40bc, 65fb1ee5) from May-June 2019 are present in the upstream release and were already included when TuxCare onboarded version 10.1.50. The vulnerable pattern (socket use-after-close leading to double-pool insertion) has been eliminated by the upstream Apache Tomcat team through: (1) CLOSED_NIO_CHANNEL dummy object pattern, (2) closed channel checks in I/O operations, (3) socket replacement in finally block of doClose(), and (4) coordinated processor management via setCurrentProcessor/takeCurrentProcessor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).", "justification": "code_not_present" } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:96b80651-db74-5bc0-87b6-f6075bdc13d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-29885 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only vulnerability where Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks. The target repository (Tomcat 10.1.50) contains the CORRECTED documentation that explicitly warns EncryptInterceptor \"does not protect against all risks associated with running a Tomcat cluster on an untrusted network, particularly DoS attacks.\" The fix was included in the upstream Apache Tomcat release (commit 0fa7721f11d by markt@apache.org, 2022-05-10) before TuxCare onboarded version 10.1.50. The vulnerable documentation pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).", "justification": "code_not_present" } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:e108ab91-6aaa-545d-861f-dd4970be94b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2022-34305. The XSS vulnerability in the Form authentication example (webapps/examples/jsp/security/protected/index.jsp) has been fixed with HTML entity encoding via util.HTMLFilter.filter(). The fix commit d6251d1cfb was authored by upstream Apache developer Mark Thomas (markt@apache.org) and was already present in the upstream release 10.1.5...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:ac41cd11-dce2-5750-9cac-121dddc9025c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.50. The fix was already included in the upstream Apache Tomcat 10.1.50 release (commit bb4624a9f3 by Mark Thomas, dated Aug 22, 2023) before TuxCare onboarded this version. The vulnerable pattern - lack of protection against protocol-relative redirects (URLs starting with //) in...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:99233981-1277-56a4-b386-137b4ea98121", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...", "justification": "code_not_present" } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:4f24b09e-0116-5517-8d2f-625e40ac214e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 is NOT AFFECTED by CVE-2023-45648. The upstream Apache Tomcat 10.1.50 release already contained the fix for improper HTTP trailer header validation. The vulnerability (unvalidated trailer headers enabling request smuggling) is not present because the code includes HttpHeaderParser with proper validation that rejects non-token characters in header names and control charact...", "justification": "code_not_present" } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:f914ef05-1f1a-5797-b1b9-b9f5a9306aba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-54677 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2024-54677 affects Apache Tomcat's examples web application (SessionExample servlet) through uncontrolled resource consumption. The vulnerability allowed unlimited session attributes to be created, exhausting server memory. The target repository version 10.1.50 is not affected because the fix (SESSION_ATTRIBUTE_COUNT_LIMIT = 10) was already present in the upstream Apache Tomcat 10.1.50 rele...", "justification": "code_not_present" } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:4d73b725-7d27-51d3-8ce7-1d23101dd794", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49124 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. The target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-49124. The upstream fix (commit e0e0781222 by Mark Thomas) that adds full path $SYSDIR\\ prefix to all icacls.exe calls was already included in the Apache Tomcat 10.1.50 release. TuxCare onboarded version 10.1.50 which already contained this upstream security fix. All three icacls invocations in res/install-win/tomcat.nsi (lines 382, 395, 408) correctly use '$SYSDIR\\icacls' instead of the vulnerable bare 'icacls' pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).", "justification": "code_not_present" } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:f93ba2aa-034a-5fe6-bc9a-79a87c604039", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. The target Tomcat 10.1.50 repository is NOT AFFECTED by CVE-2025-55752. The vulnerability involved incorrect URL processing order in RewriteValve where normalization occurred before decoding, allowing attackers to bypass security constraints for /WEB-INF/ and /META-INF/ using percent-encoded paths. The fix (decode-then-normalize) was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded, authored by Mark Thomas (markt@apache.org) in commit 130d36d8492ef9e4eb22952c17c92423cb35fd06. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:771ea9e5-4e40-5240-aad5-eb98b4e176f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55754 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2025-55754 is NOT present in Tomcat 10.1.50. The vulnerability (ANSI escape sequences in log messages allowing console manipulation) was fixed by upstream Apache in commit 138d7f5cfa which added LogUtil.escape() to sanitize control characters. This fix was already included in the Apache Tomcat 10.1.50 release that TuxCare onboarded. The defense escapes all control characters (except tab, newline, carriage return) to Java \\uNNNN format before writing to log output, preventing console manipulation attacks. Fix author: Mark Thomas (upstream Apache, not TuxCare backport).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).", "justification": "code_not_present" } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:ddd321eb-f1d1-50aa-afae-49cfcd39bec7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-61795 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-61795. The vulnerability (temporary file accumulation from failed multipart uploads) has been fixed by upstream Apache Tomcat. The fix commit af6e918162 by Mark Thomas (markt@apache.org) was included in the upstream 10.1.50 release that TuxCare onboarded. The CVE states versions 10.1.47+ are fixed, and 10.1.50 meets this requirement. The def...", "justification": "code_not_present" } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:62ef70aa-5d35-5c41-a375-cdf9bfed70fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-66614 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. Target version 10.1.50 is NOT AFFECTED by CVE-2025-66614. The vulnerability (missing SNI-to-Host header validation that allowed client certificate authentication bypass) was fixed by Apache upstream in commit 972f9a5e2a, which shipped as part of the Apache Tomcat 10.1.50 release. The fix is present in the target at the analyzed SHA (00fc3ab247). The CVE documentation correctly identifies 10.1.50 as the first fixed version in the 10.1.x branch. TuxCare onboarded the already-fixed upstream release without needing a separate backport for this CVE on the 10.1.50 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15).", "justification": "code_not_present" } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:29ad6652-e790-57a4-b2b7-ba39333f091e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:3dd6508b-07b4-56a2-894a-1e19661d8219", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.50 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added with a code defect (using HashSet instead of LinkedHashSet), causing configured cipher preference order to be lost. Version 10.1.50 predates this feature and uses a simpler, correct implementation that properly preserves cipher order via Linke...", "justification": "code_not_present" } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:b12d74c3-e717-551d-8750-03276d29679a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:7a91bd12-545c-522a-be6a-473a05de1622", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:305ab493-4265-552d-bca0-cca2fb877e60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:fec7f832-2ae6-51fc-a7d2-64ff13fc422d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:e4342402-694e-56ac-a0b4-d0126f1c9032", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:86688f4f-ae0c-5bdf-a244-3d7687b41d1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:7faa020b-ddd2-5198-a020-8cb5890c4290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:63da780c-bb97-5905-92cc-ad58106a5c14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:989d8768-4052-544d-8519-765631b1a820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:49d62672-4f28-5ab0-beb9-7faa7c1f9354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:44852d66-d5b7-57db-9163-79639110bcfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:600d6830-fd32-5062-8e22-176ca7a37405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:09321c75-8929-5a9a-af04-9b1c91a6f1d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 10.1.50-tuxcare.4." } }, { "id": "CVE-2026-50229", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:7d1dc60a-ed21-5044-bca7-fcf097062cff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50229 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:2ffe86a1-aab0-51eb-90e6-49368cbe521d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55276", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:5db3012f-d95b-5b6a-b7c0-18ff2bf5f573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55276 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55955", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:a56782c7-57c8-52e4-b3ab-3eca1275175a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55955 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:adeb2eae-ff80-5999-8bef-2d8bb72bb96e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:56cfcda2-7138-5a6a-ae96-7dcbf5737e8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:e2671a4c-4bf6-501a-adc7-95d997b4a9bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:f75e6aed-acf4-5874-8cbe-01a34edd2072", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ], "bom-ref": "urn:uuid:271237fe-1907-58bf-86ed-6cc3e6cd5152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.50-tuxcare.3" } ] }