{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7ac92693-9bfd-5a36-99e6-e8628406b111",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2",
      "version": "10.1.55-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9b9d4720-e742-572d-b4c6-7525128331fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager application affecting versions 5.5.9-5.5.26 and 6.0.0-6.0.16. The vulnerability allowed remote attackers to inject arbitrary web script via the name parameter to host-manager/html/add. The target version (10.1.55) is not affected because the fix was already present in the upstream Tomcat 10.1.55 release when TuxCare onboarded...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:60e80ad6-ddfb-51e7-a132-539f31809a03",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2013-4590. The XXE vulnerability defense is present and enabled by default. The LocalResolver class blocks external entity resolution when blockExternal=true (the default), and StandardContext.xmlBlockExternal defaults to true (line 621). The fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream Tomcat 10.1.55 release that Tu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2a09fcec-2313-5449-a1d5-2be47cb3d71c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target (Tomcat 10.1.55-tuxcare.2) is NOT vulnerable to CVE-2015-5174. The vulnerable code pattern (paths normalizing to `/..` or `/.` without being caught) is not present because an upstream fix (commit 47ecd0d0f9 from April 2016) was already included in the Tomcat 10.1.55 release that TuxCare onboarded. This fix replaced the original CVE-2015-5174 patch's explicit equality checks with a tr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9941844b-3164-5661-bd0e-0d540fc3343f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). Version 10.1.55 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-jrcp-c39h-r29x (affected up to 9.0.0.M2), NVD (affected up to 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5a8dbe8b-f955-5401-aab2-a7a080054862",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is NOT present in Apache Tomcat 10.1.55. The vulnerability required StatusManagerServlet to be loadable by unprivileged web applications, allowing them to bypass SecurityManager restrictions and access sensitive HTTP request data including session IDs. The fix (adding StatusManagerServlet to RestrictedServlets.properties) was applied by upstream Apache in commit c8601f802df on 201...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:051260ac-f3f2-5a17-9b66-760a6b19c63a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2016-0762. The timing attack vulnerability was fixed by upstream Apache in August 2016 (commit 86b2e436099 by Mark Thomas). The fix adds `getCredentialHandler().mutate(credentials)` calls when a user is not found, normalizing authentication response times to prevent username enumeration. This fix was already present in the upstream 10.1.55 release wh...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:31f96a34-c73f-5c6b-8669-b896117459ff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 10.1.55-tuxcare.2. The vulnerability required a SecurityManager permission check in ResourceLinkFactory.setGlobalContext() to prevent unauthorized web applications from overwriting the shared global JNDI context. This fix was applied by upstream Apache Tomcat committer Konstantin Kolinko in commit 76ebc900 on 2016-01-21, over 10 years before TuxCare onboar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b1a9854a-def9-55bf-be08-de6dffc5a136",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 fix is present in Apache Tomcat 10.1.55. The vulnerability allowed malicious web applications to bypass SecurityManager and read restricted system properties via the configuration file property replacement feature. The fix was introduced by upstream Apache commit c166018201 (author: markt@apache.org) which created the PermissionCheck interface and modified SystemPropertySource to ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:23800352-e210-50ad-a2b5-8eb6fa79cbc4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6796 is not present in Apache Tomcat 10.1.55. The vulnerability allowed malicious web applications to bypass SecurityManager by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The upstream fix was applied by Apache Tomcat maintainer Mark Thomas on 2016-08-30 (commit f603f2f4595) and was already present in the upstream Tomcat 10.1.55 release that TuxCare onboarded. Both dangerous parameters are now nullified when SecurityManager is enabled, preventing the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0c3d7e97-cb6f-5f6f-b6b6-ab2cfa5370fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6797 fix is present in Tomcat 10.1.55. The vulnerability (unrestricted access to global JNDI resources without explicit ResourceLink configuration) was fixed by Apache committer Mark Thomas in commit 2859ac3eae (August 2016) and shipped in the upstream Tomcat 10.1.55 release that TuxCare onboarded. The fix implements a ClassLoader-based access registry that validates every global resource lookup, returning null for unauthorized access attempts. Both the validation logic (ResourceLinkFactory) and registration hooks (NamingContextListener) are fully present and active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9bb5e4e1-d4d1-56f9-9294-c1b160610517",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 10.1.55) is not affected by CVE-2016-6817. The vulnerability (infinite loop in HTTP/2 header parser when processing headers larger than the buffer) was fixed in upstream commit 079372fc7b by Mark Thomas (markt@apache.org) on October 20, 2016. This fix was already present in the Tomcat 10.1.55 release that TuxCare onboarded. The target code contains the complete mitigation: dynamic buffer expansion logic in Http2Parser.readHeaderPayload (lines 520-532) that prevents the infinite loop by expanding the headerReadBuffer when it reaches capacity.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d6d15e0b-666d-5d27-8c0f-b32b04c63c05",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Target version Tomcat 10.1.55 is not affected by CVE-2016-8747. The vulnerability was an information disclosure issue in the Http11InputBuffer.nextRequest() method caused by improper ByteBuffer state management between HTTP requests on persistent connections. The upstream fix (commit 452c8094 from December 2016 by Mark Thomas) was already present when version 10.1.55 was released and subsequently onboarded by TuxCare. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b7a0501a-3ccd-52ab-b2f7-9708c618021e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat versions 6.0.0-6.0.52, 7.0.0-7.0.76, 8.0.0.RC1-8.0.42, 8.5.0-8.5.12, and 9.0.0.M1-9.0.0.M18. The target version is Tomcat 10.1.55, which already contains the upstream fix (commit 864aa1199a by Mark Thomas, applied March 2017). The fix was present in the upstream release that TuxCare onboarded, so the vulnerable pattern (loss of pipelined HTTP requests during sendfile processing) is not present in this version. The target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9e08828b-131d-5529-b2fa-b0914751fd76",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5650 is NOT present in Apache Tomcat 10.1.55. The vulnerability affected versions 8.5.0-8.5.12 and 9.0.0.M1-M18, where HTTP/2 GOAWAY frame handling failed to close streams waiting for WINDOW_UPDATE, causing thread exhaustion DoS. Apache fixed this in March 2017 (commits c909f014 and 5496e193) by ensuring goaway() calls close() and close() sends CANCEL reset to all streams. These fixes were already present in the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6ed0e82a-f3ba-5f2f-a441-6c3ba40c015a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target Tomcat 10.1.55 is NOT affected by CVE-2017-5664. The vulnerability pattern (honoring non-GET HTTP methods during error dispatches to static error pages) is not present in the codebase. Both DefaultServlet and WebdavServlet have the upstream Apache fix that intercepts ERROR dispatcher requests in their service() methods and forces all error dispatches through doGet(), preventing write/delete operations regardless of the original HTTP method. The fix was authored by Mark Thomas (markt@apache.org) in May 2017 (commits 7d93527254d and 512166e056f) and shipped with the upstream Tomcat 10.1.55 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e4650a93-b734-5073-9f91-6265f850def5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.55 is NOT affected by CVE-2017-7674. The vulnerability (missing Vary: Origin header in CORS responses leading to cache poisoning) was fixed in the upstream Apache Tomcat release on May 22, 2017 (commit b94478d45b). TuxCare onboarded version 10.1.55 on a later date with this fix already present. The current code correctly adds the Vary: Origin header via ResponseUtil.addVaryF...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:24623f09-38b8-55f6-9ee4-0623b3cb8023",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in Tomcat 10.1.55-tuxcare.2. The vulnerability (HTTP/2 path parameters ignored during security constraint evaluation) was fixed by upstream Apache in May 2017 (Bug 61120). The fix was included in upstream Tomcat 10.1.55, which TuxCare onboarded in commit df13cfd2c. The target code correctly uses setBytes() to process URIs, ensuring path parameters are extracted and normalization security checks prevent directory traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ab81a3f2-c888-5cb4-be05-91902ed332f2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes environment variables without escaping, enabling XSS. The target (Apache Tomcat 10.1.55) is NOT AFFECTED because the upstream fix (commit 15fcd166ea by Mark Thomas) is already present, having shipped in the upstream 10.1.55 release that TuxCare onboarded. The fix adds HTML entity encoding via SSIMediator.ENCODING_ENTITY parameter to es...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a2a10e5b-a632-559b-a425-7314316022fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The fix was applied by upstream Apache Tomcat on December 17, 2019 (commit 3c295d913e) and was already present in the upstream Tomcat 10.1.55 re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ef7e9828-008c-5f63-a47a-e278ffc0d90f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-11996 is not present in Tomcat 10.1.55. The vulnerable code pattern (the closeIdleStreams method with a loop iterating over a potentially huge range of stream IDs) was completely removed in upstream commit 043d6581b8 which shipped in the upstream 10.1.55 release before TuxCare onboarded it. The current code uses pruneClosedStreams() which safely iterates only over actual existing streams, preventing the CPU exhaustion DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2a011cb9-5c67-5b03-aeda-bf5fe5f4a8bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13934 is NOT present in target Tomcat 10.1.55. The fix (commit c9167ae30f by Mark Thomas) was already included in the upstream Tomcat 10.1.55 release that TuxCare onboarded. The vulnerable pattern\u2014failing to release the HTTP/1.1 processor during h2c direct upgrade\u2014does not exist in HEAD. Both fix elements are present: release(processor) call at line 1286 and proper state handling at line 1295 of AbstractProtocol.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:542f53ab-16b4-595f-9dd5-19350488b3b2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target Tomcat 10.1.55 repository is NOT vulnerable to CVE-2020-13935. The fix for this WebSocket payload length validation vulnerability was already present in the upstream Apache Tomcat 10.1.55 release when TuxCare onboarded it. The required validation check (rejecting frames where the 64-bit payload length has its MSB set, resulting in a negative value) is present at WsFrameBase.java lines 254-257.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e3837d3f-fcaa-5bbe-b394-411083f84200",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 10.1.55 is not affected by CVE-2020-1935. The vulnerability targeted Tomcat 7.x, 8.5.x, and 9.x (up to versions released in late 2019/early 2020). Tomcat 10.x was released in December 2020, after the CVE was fixed, and incorporated the defenses from the start. The target code in Http11InputBuffer.java (lines 973, 976) properly rejects the two key attack vectors: (1) control characters in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9747c467-c77b-5bd4-b7a0-a7249be03a07",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.55-tuxcare.2."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:281cac6e-54ce-5111-a4ed-e4f64d00a20c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Target Tomcat 10.1.55 is NOT AFFECTED by CVE-2021-30639. The vulnerability was a regression where the errorException field in Request.java was not reset in the recycle() method, causing all subsequent async I/O requests to fail after an error. The upstream fix (adding \"errorException = null;\" at line 859) was applied by Apache developer Mark Thomas on 2021-03-24 in commit b59099e4ca, five years before Tomcat 10.1.55 was released (2026-05-05). The fix is present in the target and was included in the upstream release that TuxCare onboarded on 2026-09-22. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a55e6f74-2868-5595-8f88-992151d9e1a8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 10.0.0-M1 to 10.0.5 (and 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65). The vulnerability allows authentication bypass in JNDI Realm via unescaped LDAP special characters in usernames. Target version 10.1.55 is NOT AFFECTED - it is from the 10.1.x branch which was created after the fix was applied to upstream Tomcat in April 2021. The required escaping functions (doA...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6627ef5a-7fd4-51f0-81a1-4f4c7fd7a908",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2021-33037. The vulnerability involves HTTP request smuggling through three distinct Transfer-Encoding header parsing flaws that allowed desynchronization between reverse proxy and backend. All three upstream fixes were applied by Mark Thomas (markt@apache.org) on May 10, 2021, and shipped in the upstream Apache Tomcat 10.1.55 release that TuxCare su...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bef2c280-c94c-502d-bf8a-2988886a675e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.55 is not affected by CVE-2021-41079. The CVE affects versions 8.5.0-8.5.63, 9.0.0-M1 to 9.0.43, and 10.0.0-M1 to 10.0.2. The target version (10.1.55) is outside the affected range and already contains both upstream fixes that prevent the infinite loop vulnerability in OpenSSLEngine.unwrap(). The fixes were authored by upstream Apache developers (remm@apache.org and markt@apache.org) and were part of the upstream release 10.1.55 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:08bc3f95-bfb1-53b5-9cf7-1309be9c1825",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.55 is not affected by CVE-2021-42340. The vulnerability affected versions 10.1.0-M1 through 10.1.0-M5 where WebConnection objects were not properly released for WebSocket connections, causing memory leaks. Version 10.1.55 already contains the upstream fix from remm@apache.org (commit 80f1438ec4, Sep 2021) which properly stores the WebConnection reference during init() and closes/nulls it during destroy(). The fix was present in the upstream release when TuxCare onboarded version 10.1.55.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M1, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72), NVD (>= 8.5.60, < 8.5.72; >= 9.0.40, < 9.0.54; >= 10.0.1, < 10.0.12; = 10.0.0-milestone10; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5), cve.org (>= 10.0.0-M10, <= 10.0.11; = 10; >= 10.1.0-M1, <= 10.1.0-M5; = 10; >= 9.0.40, <= 9.0.53; = 9; >= 8.5.60, <= 8.5.71; = 8), Snyk (>= 10.1.0-M1, < 10.1.0-M6; >= 10.0.0-M10, < 10.0.12; >= 9.0.40, < 9.0.54; >= 8.5.60, < 8.5.72).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7ec3b2b0-ae89-5b60-956c-72292a8ecbc4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 fix was already present in upstream Apache Tomcat 10.1.55 release. The vulnerability involved a concurrency bug where non-atomic access to processor-wrapper mappings allowed multiple threads to share a single Http11Processor instance, causing response data to be delivered to wrong clients. The fix (commit 17f177eeb7 by markt@apache.org, March 29, 2022) implemented atomic ownershi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9c5a131b-ba65-5596-9e71-3425cb466fa1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23181 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The CVE-2022-23181 TOCTOU vulnerability is not present in Tomcat 10.1.55. The fix was included in the upstream Apache Tomcat 10.1.55 release. The vulnerable code pattern (validating canonical path but returning non-canonical File object) has been replaced with the secure pattern (storing, validating, and returning the same canonical File object). This fix was authored by Apache committer Mark Thomas (markt@apache.org) in commit 70da1aaa51e on 2022-01-12 and was already present when TuxCare onboarded version 10.1.55.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:104dfcb6-b161-521b-98ed-d33f90c62588",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Target version 10.1.55 is not affected by CVE-2022-25762. This WebSocket concurrency vulnerability affected Tomcat 8.5.0-8.5.75 and 9.0.0.M1-9.0.20. Version 10.1.55 was released by Apache well after the fix was developed (2022) and ships with the fix already integrated. The vulnerable pattern (processor not properly released during concurrent close operations) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e83309d9-e109-563c-854d-578057e9c2e3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-29885 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only vulnerability where Tomcat docs incorrectly stated that EncryptInterceptor provided adequate protection for running clusters on untrusted networks. The target version 10.1.55 contains the corrected documentation that explicitly warns EncryptInterceptor \"provides confidentiality and integrity protection but it does not protect against all risks... particularly DoS attacks.\" The fix was authored by upstream Apache developer Mark Thomas (markt@apache.org) and was included in Tomcat 10.1.0-M15. Since version 10.1.55 is much newer than the affected range (10.1.0-M1 to 10.1.0-M14), the corrected documentation was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (misleading documentation text) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5799c5d9-59e9-568d-9078-b366ebd8436c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target (Apache Tomcat 10.1.55) is not affected by CVE-2022-34305. The XSS vulnerability in the Form authentication example was fixed by upstream commit d6251d1cfb (authored by markt@apache.org), which added HTML entity encoding via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. This fix was included in upstream release 10.1.0-M1...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:04e3fe6e-fa7a-51a4-84cd-c567c48bbc7e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ab82cf3a-53c2-5e3d-9a73-9b0ca18705df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4467db8a-39e4-5df3-9ea7-b924b33dcee1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4eb5d8c0-a409-5452-b453-55d291841ee4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-54677 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2024-54677. The vulnerability affected versions 10.1.0-M1 through 10.1.33, and fixes were released in 10.1.34. Since 10.1.55 > 10.1.34, all upstream fixes are already present in this release. Verified fixes include: 10-attribute session limits in SessionExample.java and JSP examples, shopping cart restriction to pre-defined enum items in DummyCart.j...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fd5a2974-e6bf-5f53-b2f4-4fc1b1f4bf2c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49124 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2025-49124 affects Apache Tomcat's Windows installer due to untrusted PATH search when calling icacls.exe. The target version (10.1.55) is newer than the fixed version (10.1.42). Analysis confirms the fix (using $SYSDIR\\icacls instead of icacls) was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The vulnerable pattern (unqualified icacls calls) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f2a96513-8400-559f-949f-4c28604c6751",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Target version 10.1.55 is not affected by CVE-2025-55752. The vulnerability (normalizing before decoding URL-encoded path components, allowing encoded traversal sequences to bypass security checks for /WEB-INF/ and /META-INF/) was fixed in upstream Apache Tomcat 10.1.45. The fix commit (130d36d8492ef9e4eb22952c17c92423cb35fd06) was already present in the upstream 10.1.55 release that TuxCare onboarded. The RewriteValve.java code at lines 560-563 shows the correct fixed pattern: decode THEN normalize, preventing encoded path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2619820c-9222-5641-8fe7-fb7f8f765736",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55754 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target Apache Tomcat 10.1.55 is NOT affected by CVE-2025-55754. The vulnerability (unescaped ANSI control characters in log output) is not present because the upstream vendor's fix was already included in the Apache Tomcat 10.1.55 release. The fix adds LogUtil.escape() which converts control characters to \\uNNNN format before logging, preventing ANSI escape sequence injection attacks on Windows consoles. All production log formatters (JdkLoggerFormatter, OneLineFormatter, JsonFormatter) properly escape control characters. VerbatimFormatter intentionally does not escape (documented design for access logs).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5cb291a6-8b87-53a9-8ae7-cc30774c06b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-61795 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bac3442f-63f7-50a1-aa56-6c3116c34b88",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-66614 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 10.1.55) is NOT affected by CVE-2025-66614. The vulnerability, which allowed client certificate authentication bypass via mismatched SNI and HTTP Host headers, was fixed in upstream Apache Tomcat version 10.1.50. Since the target is version 10.1.55, the fix was already present in the upstream release that TuxCare onboarded. The fix commit (972f9a5e2a) authored by remm@apache.org is an ancestor of HEAD and predates all TuxCare commits in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d5a5569-2284-559e-b739-0b4ae3a95165",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25854 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b41da3dc-3174-59b8-9f61-c088aa184220",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-29129 (cipher preference order not preserved). The vulnerability was fixed in upstream commit 8d69b33764 (February 20, 2026) by Apache committer remm@apache.org, which changed HashSet to LinkedHashSet in SSLHostConfig.getJsseCipherNames() to preserve insertion order. This fix was already present in the upstream 10.1.55 release that Tu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:96b87e3f-5024-5454-bc8a-290b060c03eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29145 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2026-29145: CLIENT_CERT authentication bypass when OCSP responds with TRY_LATER and soft fail is disabled. The vulnerability is NOT present in Tomcat 10.1.55. The fix was already included in the upstream Apache Tomcat 10.1.55 release (commit fe26667cd2) before TuxCare onboarded this version. The fix ensures OCSP TRY_LATER responses set X509_V_ERR_UNABLE_TO_GET_CRL error, causing authentication to fail when soft fail is disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.83, < 9.0.116; >= 10.1.0-M7, < 10.1.53; >= 11.0.0-M1, < 11.0.20; >= 9.0.83, < 9.0.116; >= 10.1.0-M7, < 10.1.53; >= 11.0.0-M1, < 11.0.20), NVD (>= 9.0.83, < 9.0.116; >= 10.1.1, < 10.1.53; >= 11.0.0, < 11.0.20; = 10.1.0; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone20; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; >= 1.1.23, < 1.3.7; >= 2.0.0, < 2.0.14), cve.org (>= 11.0.0-M1, <= 11.0.18; >= 10.1.0-M7, <= 10.1.52; >= 9.0.83, <= 9.0.115; >= 1.1.23, <= 1.1.34; >= 1.2.0, <= 1.2.39; >= 1.3.0, <= 1.3.6; >= 2.0.0, <= 2.0.13), Snyk (>= 10.1.0-M7, < 10.1.26; >= 11.0.0-M1, < 11.0.0-M24; < 9.0.116; >= 10.1.0-M7, < 10.1.53; >= 11.0.0-M1, < 11.0.20; >= 9.0.93, < 9.0.116; >= 10.1.26, < 10.1.53; >= 11.0.0-M24, < 11.0.20).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:62bfc32d-515f-57b1-b019-a53415bcb8ec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29146 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f005478e-f27f-515f-9ee2-00a3cbc45735",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a1fdfcfd-4a00-5369-9192-d4f42d518837",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34483 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.55 is not affected by CVE-2026-34483. The vulnerability (improper encoding/escaping of URI and query strings in JsonAccessLogValve) was fixed in upstream Apache Tomcat 10.1.54 (commit f22dc2ce6c by Mark Thomas). Version 10.1.55 already contains this fix from the upstream release. All URI and query string values are properly escaped via escapeAndAppend() before being written to access logs, preventing log injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.40, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.40, <= 9.0.116; >= 8.5.84, <= 8.5.100), Snyk (< 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:418731b5-e878-5072-b9cd-7438585522b0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34486 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.55 is not affected by CVE-2026-34486. The vulnerable code pattern (calling super.messageReceived(msg) after the try-catch block, allowing unencrypted messages to bypass encryption) is not present. The fix commit 55f3eb9148233054fccfdf761141c6894a050be1 by Mark Thomas (markt@apache.org) was already included in the upstream 10.1.55 release that TuxCare onboarded. The current code correctly places super.messageReceived(msg) inside the try block (line 142), ensuring messages are only forwarded to the next interceptor when decryption succeeds.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.20, < 11.0.21; >= 10.1.53, < 10.1.54; >= 9.0.116, < 9.0.117; >= 11.0.20, < 11.0.21; >= 10.1.53, < 10.1.54; >= 9.0.116, < 9.0.117), NVD (= 9.0.116; = 10.1.53; = 11.0.20), cve.org (= 11.0.20; = 10.1.53; = 9.0.116), Snyk (>= 9.0.116, < 9.0.117; >= 10.1.53, < 10.1.54; >= 11.0.20, < 11.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:28ad4e96-89c0-5113-911d-d76f87d735c3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34487 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-34487. The vulnerability (Kubernetes bearer token exposure in log files) has been fixed by upstream Apache in commit 5eff2a773b8b728083e5195b3183df1b9e12a03d, which was already included in the 10.1.55 release that TuxCare onboarded. The CVE affects versions through 10.1.53 and is fixed in 10.1.54; since 10.1.55 > 10.1.54, the fix was already present in the upstream release. All three files show the patched version: AbstractStreamProvider.java removes headers from debug logs, TokenStreamProvider.java removes token from exception messages, and LocalStrings.properties updates message templates accordingly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.13, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.13, <= 9.0.116), Snyk (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d6780e3c-5c6d-54df-bb6c-66c7e810497d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41284 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target (Apache Tomcat 10.1.55) is not affected by CVE-2026-41284. The fix for unbounded WebDAV request body buffering was already present in the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded. The vulnerable pattern (unbounded ByteArrayOutputStream) has been replaced with BoundedByteArrayOutputStream enforcing a 4096-byte default limit on LOCK and PROPFIND request bodies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 4.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100; >= 4.0, <= 7.0.109), Snyk (>= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:417a5e06-9568-5ca9-b0e8-c7dc6dafe2d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41293 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target Tomcat 10.1.55 is not affected by CVE-2026-41293. The vulnerability (unvalidated HTTP/2 headers allowing invalid characters to reach the application) was fixed in the upstream Apache Tomcat 10.1.55 release via commit 19f17a257797e8d139b33ff9c88d362a273be148 by Mark Thomas (markt@apache.org). TuxCare onboarded this version with the fix already present. All required validation code is in place: HPackHuffman.java and HpackDecoder.java validate characters during HPACK decoding, rejecting field names with non-token or uppercase characters and field values with invalid characters, and Http2Parser.java properly handles validation exceptions by throwing StreamException with PROTOCOL_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2ec9f6a7-ca2a-5afa-ae2f-f749768d4ba7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42498 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target repository at version 10.1.55 is not affected by CVE-2026-42498. The vulnerability involves WebSocket authentication credentials being leaked to redirect target hosts. The fix, which removes authentication headers after successful authentication or redirects, was authored by upstream Apache (Mark Thomas, markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release. This fix is present in the target repository as commit 6cbe274592, which predates all TuxCare commits. The CVE itself states that version 10.1.55 is the fixed version (affected: 10.1.0-M1 to 10.1.54).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.2, <= 9.0.117; >= 8.5.24, <= 8.5.100; >= 7.0.83, <= 7.0.109), Snyk (>= 7.0.83, < 8.0.1; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6e09b5c9-b7ee-55dc-9405-af7e6c3e53c8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43512 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 10.1.55 is not vulnerable to CVE-2026-43512. The fix was included in the upstream Apache Tomcat 10.1.55 release (the first fixed version per CVE). The vulnerable pattern - where null passwords from non-existent users were converted to the string \"null\" in DIGEST authentication digest calculations - is not present. Upstream commit 3d4d3fae07 by Mark Thomas (markt@apache.org) added a null check that immediately returns null from getDigest() when getPassword() returns null, preventing the authentication bypass. This fix shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:29e5b472-bd53-5cd4-8ef6-225f70b3ebbc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43513 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. The target Apache Tomcat 10.1.55 repository is not affected by CVE-2026-43513. The vulnerability (improper handling of case sensitivity in LockOutRealm allowing lockout bypass via case-variant usernames) has been fixed by upstream commit 4a90d3fa93, which was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix adds username normalization to lowercase (when caseSensitive=false, the default) in all three critical methods: isLocked(), registerAuthSuccess(), and registerAuthFailure().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:034396c0-4d87-54c5-8bcb-b5b1afe36e1c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43514 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0d7e4a61-8eb4-58b0-bd79-04568cad9c78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43515 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2026-43515 is NOT present in Apache Tomcat 10.1.55. The vulnerability (only first HTTP method constraint applied for extension patterns) was fixed by upstream Apache in commit c621317382682206fb58ab92ebd3e1b6fdd10ce9 by Mark Thomas, which shipped in the 10.1.55 release. The target code has the fixed pattern: 'matched' variable declared inside the collection loop, checking collection[j].findMethod(method) for each matching collection rather than only collection[pos] after the loop. TuxCare onboarded 10.1.55 with this upstream fix already present. CVE states fixed in 10.1.55+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7cdec2d1-62e4-5b5a-a36c-7445c160a2c9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:188099b7-b946-5634-a52b-fe5d4efeec3a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee01cdfc-87b8-5811-b200-22483fe6e0d6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cc2b5de7-922f-533a-bcbc-2e432f808159",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4a4e881c-d4c2-5db2-9781-531384772de1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8f0aa2a6-5d5e-56b1-bd80-0ff02b55899d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:37890a6c-2bb4-5c44-80d4-21e6b69a6423",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7ecfd0d9-34ae-59f7-845c-4a415e102102",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4da1a5d1-4fbe-51f2-a8af-2df3979b5963",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.55-tuxcare.2"
    }
  ]
}