{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c86b613a-47fc-5b68-8e3d-efee13a8be2b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8",
      "version": "9.0.75-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.75",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.75"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c8f29af0-d8c5-598f-b611-81f24cd419fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 XSS vulnerability in Apache Tomcat host-manager is NOT AFFECTED in version 9.0.75. The fix for this CVE (commit 49c71fc59c by Mark Thomas, Apache) was applied on June 2, 2008, and was already present in the upstream Apache Tomcat release that TuxCare onboarded for version 9.0.75. The current code properly escapes the hostname parameter using Escape.htmlElementContent() before rend...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ee430076-18d5-526c-bb4d-f96ec27f1543",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE vulnerability in Tomcat XML parsing) is NOT present in target version 9.0.75. The fix was already included in the upstream Apache Tomcat 9.0.75 release (May 2023) that TuxCare onboarded, approximately 10 years after the original vulnerability was fixed in December 2013. The vulnerable pattern (unrestricted external entity resolution) is absent because the blockExternal mechan...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:05a91b92-7e91-5501-9d10-719ca5b074b3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. Version 9.0.75 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-6qr6-x7jm-x2q6 (affected below 8.0.27), NVD (affected up to 8.0.26).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4066b2c3-9f27-5b3c-ba98-984be96368dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.75 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f17cf920-4af1-5e38-b096-1811bdd016e7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is not present in Tomcat 9.0.75. The upstream fix (commit c8601f802d from 2016-01-04) was already included in the base release. StatusManagerServlet is correctly listed on line 19 of RestrictedServlets.properties, and the DefaultInstanceManager enforcement mechanism prevents unprivileged web applications from loading it. The privileged flag defaults to false (StandardContext.java:...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d059d474-c4a2-59ef-9e1c-dd6e3223868b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 9.0.75. The fix was shipped in the upstream Apache Tomcat release that this version is based on. All four affected Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the timing attack mitigation: when a username is not found, they call getCredentialHandler().mutate(credentials) to process the pass...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9b2c76ed-d9ab-534f-af0f-881616a9943e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 9.0.75-tuxcare.7. The vulnerability concerned missing authorization checks on ResourceLinkFactory.setGlobalContext(), which allowed malicious web applications to modify the global JNDI context and access arbitrary application data. The fix (SecurityManager permission check) was added by upstream Apache in January 2016 (commit 76ebc900) and shipped in Tomca...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4c96ac6e-d2f5-510e-84aa-4a8e48c98a64",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 describes a SecurityManager bypass where web applications could use configuration file system property replacement to read restricted system properties. The target Apache Tomcat 9.0.75 is not affected because the upstream fix was already present in the 9.0.75 release. The fix (commit c1660182 by Apache developer Mark Thomas in 2016) added three components: (1) PermissionCheck inte...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:98dbca8e-a550-5d4f-a2f2-4772e7e21b5c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2016-6796 describes a SecurityManager bypass via manipulation of JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by specifying custom Options classes or arbitrary scratch directories. The upstream fix by Mark Thomas (Apache Tomcat) added runtime checks to ignore these dangerous parameters when SecurityManager is enabled. This fix was included in Apache Tomcat 9.0.0 (released August 2016) and is present in the target version 9.0.75-tuxcare.7. The vulnerable pattern (unprotected use of these configuration parameters) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f33757cd-4f0d-59e1-9f57-227e4452311f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Tomcat 9.0.75-tuxcare.7. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The upstream fix (commit 2859ac3eae by Apache committer Mark Thomas) was already present in the upstream release before TuxCare's work began. The fix implements a ClassLoader-keyed allowlist that validates global resource access before lookup, blocking unauthorized access by returning null when validation fails.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6c245d81-1398-5c3e-b8b1-da6b773a78e7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2016-6817 (HTTP/2 header parser infinite loop DoS) is NOT present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability was fixed in upstream Apache Tomcat commit 079372fc7b (Oct 2016, bug 60232) by Mark Thomas, which added dynamic buffer expansion logic to prevent infinite loops when headers exceed buffer capacity. This fix was included in the upstream 9.0.75 release (April 2023) that TuxCare onboarded, well before TuxCare's first commit e04fd1feb3. The buffer expansion defense is present and active in Http2Parser.java lines 479-491.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8dc97c61-e939-563b-a6bf-cacf8f9111fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 9.0.0.M11 to 9.0.0.M15 due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could cause data from one HTTP request to leak into another. The target (Tomcat 9.0.75-tuxcare.7) contains the upstream Apache fix: lines 293-294 properly call byteBuffer.flip() after compact(), ensuring correct position/limit state. This fix was authored by Mark Thomas (markt@apache.org) in commit 98466fdc1e6 on 2016-12-14, which predates TuxCare's first maintenance commit. The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:832ed2d5-94f7-5211-bb42-895d1687b3c0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. Tomcat 9.0.75 is not affected by CVE-2017-5647. The vulnerability was fixed in upstream Tomcat in March 2017 (commit 864aa1199a by Mark Thomas), before the 9.0.75 release. The fix introduces SendfileKeepAliveState enum to distinguish between pipelined requests vs. awaiting new data on keep-alive connections. When sendfile completes, the code now checks if pipelined data already exists in the input buffer (via available(false)==0) and immediately processes it (PIPELINED state) instead of returning the socket to the poller, which would lose the pipelined request. The vulnerable pattern (boolean keepAlive field without pipelined detection) is completely absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:72b88f28-fa15-5c2c-a38b-b1b8e59099ed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2017-5650 is NOT present in Apache Tomcat 9.0.75. The vulnerability involved HTTP/2 GOAWAY frames not closing associated streams waiting for WINDOW_UPDATE, leading to thread exhaustion. The upstream fix (commits 5496e193 and c909f014 by Mark Thomas, March 2017) was already included in version 9.0.75 before TuxCare onboarding. The fix ensures that when a GOAWAY frame is received, the goaway() method calls close(), which iterates through all streams and sends them a RESET signal via receiveReset(Http2Error.CANCEL.getCode()). Both defense mechanisms are present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a0038124-3e58-5034-9817-5784027ae3bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability, which allowed static error pages to be modified or deleted via non-GET HTTP methods when the DefaultServlet permits writes, was fixed by Apache upstream in May 2017 (commit 7d93527254d9e9371b342800617f20d13c8b85ad). The fix intercepts error dispatches and forces them to process via doGet() regardless of the original HTTP method. This fix was already present in the upstream Apache Tomcat 9.0.75 release that TuxCare onboarded, predating all TuxCare modifications to this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:62590ff0-6a41-5598-907d-3eacbef03ee5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is not present in Apache Tomcat 9.0.75. The vulnerability (CORS Filter missing HTTP Vary header, allowing cache poisoning) was fixed in the upstream release. The fix was introduced in commit e76f746e2d (July 2018) by Apache committer Mark Thomas, which predates the first TuxCare commit in this branch. The current code includes the defense: CorsFilter.addStandardHeaders() adds 'Var...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:44c971ed-8d18-5867-aafe-57526c149883",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in Apache Tomcat 9.0.75. The vulnerability affected HTTP/2 path parameter handling in versions 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15. The target version (9.0.75) already contains the upstream fix committed by Mark Thomas (markt@apache.org) in commit cf181edc9a. The fix changes URI storage from setString() to setBytes() to ensure path parameters are properly extracted before security constraint evaluation. This fix was already present in the upstream Tomcat 9.0.75 release that TuxCare onboarded, so the vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:05bf1318-c142-528f-96e8-796ed29069aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which outputs environment variables without HTML encoding, enabling XSS attacks. The target Apache Tomcat 9.0.75 repository is NOT AFFECTED because the upstream fix (commit 15fcd166ea by markt@apache.org from March 2019) was already present in the Apache Tomcat 9.0.75 release that TuxCare onboarded. The code at HEAD correctly uses getVariableValue(...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:760dba56-5f22-5852-ae5d-3bd6a273f85d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28-9.0.30 (regression in Transfer-Encoding header parsing). The target version 9.0.75 (released May 2023) contains the upstream fix from December 2019 (commit 060ecc5e by Mark Thomas). The fix validates Transfer-Encoding headers using TokenList.parseTokenList() and rejects invalid values with HTTP 400 Bad Request. The vulnerable pattern (accepting invali...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:754fc7de-117b-5f43-81ea-7f5ccfd8c032",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. Version 9.0.75 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. While it contains the affected file (Http2UpgradeHandler.java) and method (closeIdleStreams), the implementation uses a semantically equivalent mitigation that prevents the high CPU usage vulnerability. Instead of iterating through all possible stream IDs, it uses ConcurrentNavigableMap.subMap() to efficiently extract only actual streams within the relevant range. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:27022ef6-c717-5372-ac6d-6c10d53c4e91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:dc72ab84-d667-5391-8cf7-6ae1ddf698b9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2020-13935 is NOT present in Apache Tomcat 9.0.75. The vulnerability (invalid WebSocket payload length validation causing infinite loop) was fixed in upstream Apache Tomcat 9.0.37 by commit 40fa74c748 authored by Mark Thomas (markt@apache.org). The target version 9.0.75 includes this upstream fix, which validates that 64-bit payload lengths are non-negative before processing. The fix is present in WsFrameBase.java:252-255 and applies to all WebSocket frame processing (both client and server) since WsFrameClient and WsFrameServer inherit from WsFrameBase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6fdfef08-aaad-53e4-a03e-01ca8e3fc70f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 9.0.75-tuxcare.7 is not affected by CVE-2020-1935. The vulnerability involved accepting HTTP headers with improper line endings (CR not followed by LF) and control characters in header values, enabling HTTP Request Smuggling. The fix enforcing strict CRLF validation and rejecting control characters (except TAB) was applied by upstream Apache maintainer Mark Thomas in co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4da167ad-2252-554a-8721-2c4b20e3614a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.75-tuxcare.8."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:927d7ee7-6094-583e-8ccc-ae37794fda60",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2021-30639. The vulnerability involved the errorException field not being reset in the Request.recycle() method, causing error state to persist across requests and enabling DoS attacks. The fix (errorException = null; at line 752) was already present in the upstream Apache Tomcat 9.0.75 release before TuxCare onboarded it. The fix commit (8ece47c4a9) was authored by Mark Thomas (markt@apache.org) and was an ancestor of the first TuxCare commit (e04fd1feb3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:afb0905f-f70c-5433-9b9b-3042cd81b4ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 9.0.0.M1 to 9.0.45. The target is running Tomcat 9.0.75-tuxcare.7, which is based on upstream Apache Tomcat 9.0.75. The vulnerability allows authentication bypass through special characters in usernames that manipulate LDAP queries in the JNDI Realm. The fix (proper escaping per RFC 4514 and RFC 2254) was applied by Mark Thomas in upstream Apache Tomcat via ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:12e7652a-4d4b-5ba2-8cc8-4348f187853d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in Apache Tomcat 9.0.75. All three required defenses are present in the target code and were shipped in the upstream Apache Tomcat 9.0.75 release (May 2023), authored by markt@apache.org. The CVE affects versions 9.0.0.M1 to 9.0.46; version 9.0.75 is beyond this range. The vulnerable transfer-encoding parsing patterns have been replaced with secure implementations ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8e8a33a0-0c77-5a03-bbc9-5711ca6704d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2021-41079 describes an infinite loop DoS vulnerability in Apache Tomcat's OpenSSL TLS packet handling (NIO+OpenSSL, NIO2+OpenSSL). The target (Tomcat 9.0.75) is NOT AFFECTED because both upstream fixes are present: (1) commit 95ceaf7b32 (Jan 2021) adds a check preventing infinite loop when destination buffer state changes concurrently (idx==endOffset guard), and (2) commit d4b340fa8f (Mar 2021) prevents infinite loop when bytesRead returns zero despite pending data. Both fixes were authored by Apache developers (remm@apache.org, markt@apache.org) and shipped in the upstream 9.0.75 release before TuxCare onboarded this version. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:fbdd5e20-196e-5995-8bc2-827cf7b459cb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. Version 9.0.75 is not affected by CVE-2021-42340: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9\". No backport needed."
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:dabf6efe-667b-5a8f-b38d-f918b2595506",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 9.0.75 is NOT affected by CVE-2021-43980. The vulnerability (concurrency bug causing Processor instance sharing between client connections) was fixed in upstream commit 170e0f792b (March 2022) by Mark Thomas, well before the 9.0.75 release (May 2023). The fix uses AtomicReference for thread-safe Processor ownership and introduces takeCurrentProcessor() for atomic get-and-cl...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:767efc09-5c01-5f53-bad8-6ab60d4b530f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23181 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2022-23181 is NOT present in Apache Tomcat 9.0.75-tuxcare.6. The TOCTOU (Time-Of-Check, Time-Of-Use) vulnerability in FileStore.java's file() method has been fixed. The vulnerable pattern (checking canonical file but returning non-canonical file) is absent. The fix was authored by Apache committer Mark Thomas (markt@apache.org) in commit 1385c624b4, which predates all TuxCare work on this branch and was already present in the upstream Apache Tomcat 9.0.75 release that TuxCare onboarded. According to the CVE, affected versions are 9.0.35 to 9.0.56; version 9.0.75 is beyond this range and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d857c17c-c406-51b6-9863-df19cc374a80",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. Target Tomcat 9.0.75 is not affected by CVE-2022-25762. The vulnerability affects Tomcat 9.0.0.M1 to 9.0.20. The fix was introduced in upstream commit e2d5a040 (May 2019) and first released in Tomcat 9.0.21. The target version 9.0.75 was onboarded by TuxCare with all upstream fixes already present, including: (1) CLOSED_NIO_CHANNEL sentinel pattern preventing socket reuse after close; (2) ClosedChannelException checks before I/O operations; (3) WebSocket processor lifecycle management via setCurrentProcessor/takeCurrentProcessor preventing double-pooling during concurrent close operations. These are upstream-authored fixes by remm@apache.org, not TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6bcf10bd-b726-5724-93c4-54e00620602b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-29885 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation vulnerability where Tomcat's documentation incorrectly stated that EncryptInterceptor enables safe clustering over untrusted networks. The target repository (Tomcat 9.0.75) already contains the corrected documentation that was shipped in the upstream release. All three affected documentation files (cluster-howto.xml, config/cluster.xml, security-howto.xml) properly state that EncryptInterceptor does not protect against all risks on untrusted networks, particularly DoS attacks. The fix was authored by upstream maintainer Mark Thomas (markt@apache.org) in May 2022, before the 9.0.75 release in May 2023.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9df95c6d-2e42-5db5-ab90-b7d00729e844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-34305 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c931ab16-1cfb-5187-a8a8-62217cd9ea58",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0d741f8f-c751-565a-8726-82278091cc08",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f6fa8d54-1085-5358-8cc3-ed527eaa3752",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d60cbf6e-878b-5d34-a7df-a003e5a85f32",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-54677 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:59e367aa-8fe2-591d-bf56-d233750f7e6d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:409aac47-d072-5b2b-a095-e7a43acb68d8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8bba12f8-a3fb-5d00-9b94-8af7c3e14559",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e953e81a-98fa-5cac-a3d8-d41a0d3b6ea1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:de8e8c83-4bce-5856-bc25-17c541089bc0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66614 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:07b538e5-9070-52fe-860c-4095f56d8965",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f4575455-4f81-51b7-8c43-57f844b72127",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.75 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 9.0.114 when TLS 1.3 cipher suite support was added (commit 4ee45c5571, Jan 6 2026), which used a HashSet in getJsseCipherNames() that failed to preserve cipher ordering. Version 9.0.75 predates this feature by 39 minor versions and uses a simpler, non-vulnerable code path that maintains cipher o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a65daa6c-8aac-513f-b794-62c0c55c72de",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:eb0c61cd-d260-5efb-a1fd-61da0c23676e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6f66fcd9-a911-5b0a-b144-25101927472f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d1347762-ae05-546e-b778-55d4d93fe16f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0161dc06-f15a-58ea-a71a-fa25a87118db",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34486 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:622f7f88-f28b-5dcb-9f63-e1a422dade41",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34487 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:276e33d4-bda6-5317-ae92-55b8a635c08f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:294247c2-f37e-5f75-91df-6c5eec3b59ff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c254767b-96a8-510b-bf57-66040262f32b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:172dc56f-1722-55da-a022-7faf9e0df3b5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bae336db-aa83-56aa-884f-a20b51148f89",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:060dc559-f847-5dd3-9387-576991adf829",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0ce1d5c8-6baa-54ce-81f9-d7fa3e7dadcd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43515 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f4dfebae-f4ff-5656-8b2d-300d55d74ea1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d22be77a-0327-5b22-a884-474837203901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:79d3663c-a277-542b-93c6-1ab66996af5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:15f5bf90-a351-52e5-8806-c2ec61232746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9654fff4-e1b1-570f-88e0-2589a70e7ede",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:476bc9b6-811f-559a-a6f7-2290c0d3267e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:b8f9624f-d775-5081-adfe-2f2977e23d2f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0a632716-2f91-524c-8d4f-49644743e12f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:210cd9aa-f5c9-5535-bd40-e1b57e69be1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68525 affects version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.75-tuxcare.8"
    }
  ]
}