{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:54cbd048-c49e-5f66-8108-e2950c8bff47", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7", "version": "9.0.83-tuxcare.7", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83", "type": "library", "group": "org.apache.tomcat", "version": "9.0.83" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:76e55800-be9f-5e64-849c-18a668131c41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 XSS vulnerability is not present in Apache Tomcat 9.0.83. The vulnerable code pattern (unescaped reflection of the 'name' parameter in HTML output) was fixed by Apache upstream in commit 17fdaef177 (Oct 2017), which introduced the Escape.htmlElementContent() defense. This fix shipped in the upstream 9.0.83 release before TuxCare onboarded it. The defense encodes HTML metacharacter...", "justification": "code_not_present" } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:ff0f916f-8a51-59bf-8d48-9dea4d11d204", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.83 is not affected by CVE-2013-4590 (XXE vulnerability in XML configuration file parsing). The upstream fix was introduced in commit 05c84ff830 on 2013-12-09 by Apache developer Mark Thomas, long before TuxCare began maintaining this version in 2025. The fix adds a `blockExternal` parameter to LocalResolver that blocks external entity resolution when entities are not in the we...", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:f9373c8d-c73b-54e9-b4fe-8c6f0a77ce35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.83 is NOT AFFECTED by CVE-2015-5174. While RequestUtil.normalize() lacks the vendor's specific fix (post-normalization checks for \"/.\" and \"/..\"), an alternative defense in AbstractFileResourceSet.file() blocks the attack chain. The file() method validates that the canonical path of any requested resource stays within the web application's base directory (lines 92-99), rejecti...", "justification": "protected_at_runtime" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:526fe053-0d5c-5e37-8935-ea3cd20cd8ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). The upstream fix was released in 9.0.0.M2, and version 9.0.83 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).", "justification": "code_not_present" } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:eb433e3a-e354-55bc-9e98-ad2a2d4682ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is not present in Apache Tomcat 9.0.83. The vulnerability required StatusManagerServlet to be missing from the RestrictedServlets.properties list, allowing unprivileged web applications to load it and read arbitrary HTTP requests/session IDs. The target already contains the upstream fix at RestrictedServlets.properties:19 where StatusManagerServlet is marked as restricted. The fix...", "justification": "code_not_present" } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:f16d1f79-d8f3-576c-ae00-9fa9f8bdd927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 9.0.83. The timing attack mitigation was introduced by upstream commit 86b2e436099cb48f30dad950175c5beeeb763756 (Mark Thomas, 2016-08-30), which shipped in Tomcat 9.0.0-M10. The CVE affects versions up to 9.0.0.M9. All four realm implementations modified by the upstream patch (DataSourceRealm, JDBCRealm, MemoryRealm, RealmBase) ...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:f339d04f-0c15-589f-a0b8-e62f4432a24e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not present in the target. The vulnerability was fixed in the upstream Apache Tomcat release (9.0.0.M3, January 2016) and the fix was already present in version 9.0.83 before TuxCare onboarded it. The required SecurityManager permission check in ResourceLinkFactory.setGlobalContext() is present in the target code at lines 61-65, preventing unauthorized callers from modifying th...", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:642f8ec8-d638-5d9c-b758-dff93597e655", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is not present in Tomcat 9.0.83. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through configuration file property replacement. The fix was implemented by Apache Tomcat upstream (Mark Thomas, markt@apache.org) on July 28, 2016 in commit c1660182010b4255c21c874d69c124370a67784a, which added the PermissionCheck interface...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:81e8b402-85b7-5d15-8384-a48b688bf436", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-6796 is not present in Apache Tomcat 9.0.83. The vulnerability allowed malicious web applications to bypass SecurityManager by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The fix was already present in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded. Both vulnerable parameters are now ignored when SecurityManager is enabled, preventing the bypass attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:43ba6801-e291-57c8-9785-daaffe4e7139", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Tomcat 9.0.83. The upstream Apache fix (commit 2859ac3eae by Mark Thomas, dated Aug 22, 2016) was already included in the Tomcat 9.0.83 release that TuxCare onboarded. The fix adds a per-ClassLoader registration system in ResourceLinkFactory that enforces an allowlist: web applications can only access global JNDI resources explicitly configured via ResourceLink. The validation check blocks unauthorized access by returning null. All defense components are present and functional in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:233cd7f1-ce8f-548d-92c7-936aee725ea4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-6817: Target Tomcat 9.0.83 is NOT AFFECTED. The vulnerable infinite-loop pattern in HTTP/2 header parsing was already fixed in the upstream release that TuxCare onboarded. The fix (dynamic buffer expansion preventing zero-progress loops) is fully present in Http2Parser.java lines 510-548 and 664-667, introduced by upstream commit 079372fc7b (Mark Thomas, 2016-10-20), which predates all TuxCare activity on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:39de8ba6-8e4e-5dcc-a2fc-3e464b2669a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-8747 is not present in Apache Tomcat 9.0.83. The vulnerability involved missing ByteBuffer.flip() call after compact() in Http11InputBuffer.nextRequest(), which could cause data from one HTTP request to leak into another request. The fix (commit 452c8094a6 by Mark Thomas on Dec 14, 2016) was already present in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded it. The target code correctly calls byteBuffer.flip() at line 294 after byteBuffer.compact() at line 293.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:6c8e4ca4-4982-577f-b47e-3d55d3a38308", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.83 is not affected by CVE-2017-5647. The vulnerability (pipelined HTTP request loss during sendfile processing) was fixed in upstream Apache Tomcat and the fix was already present in the 9.0.83 release that TuxCare onboarded. The fix commit 864aa1199a by Mark Thomas (markt@apache.org) introduced SendfileKeepAliveState enum with PIPELINED/OPEN/NONE states to distinguish pipelined data already in the buffer from awaiting future data, preventing request-response misalignment.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:410c983d-8ade-5703-852a-19da3f1fc4d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2017-5650 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12. The target is Tomcat 9.0.83-tuxcare.6, which already contains the upstream fix. The vulnerability allowed malicious clients to exhaust server threads by sending HTTP/2 GOAWAY frames without properly closing streams waiting for WINDOW_UPDATE. The fix adds stream cleanup in the close() method and calls close() when GOAWAY is received. Both fixes were applied by upstream Apache developer Mark Thomas in March 2017 (commits 5496e193a8 and c909f01471) and were already present in the upstream 9.0.83 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:d78397d1-3c07-5f7e-bc1c-2a34e2dac531", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Apache Tomcat 9.0.83. The vulnerability concerns the DefaultServlet and WebdavServlet forwarding error dispatches with the original HTTP method, potentially allowing modification/removal of static error pages. The upstream fix (commit 7d93527254d9e9371b342800617f20d13c8b85ad by Mark Thomas, dated May 2, 2017) was already present in the upstream release 9.0.83 that TuxCare onboarded. Both DefaultServlet.java (lines 498-505) and WebdavServlet.java (lines 312-315) contain the fix: they check if req.getDispatcherType() == DispatcherType.ERROR and force processing through doGet() regardless of the original request method, preventing write operations on error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:4fc3a996-7359-51b5-999a-5be740091d5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M21 (and earlier 8.x/7.x series). The vulnerability is a cache poisoning issue: the CORS filter did not add a Vary: Origin HTTP header, allowing caches to incorrectly serve a response intended for one origin to requests from different origins. The fix was applied by Apache upstream in commit b94478d45b (May 22, 2017) and included in...", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:92d6340d-78f4-5cdc-a7aa-6ce858d29b50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in Apache Tomcat 9.0.83. The vulnerability affected Tomcat 9.0.0.M1 through 9.0.0.M21, where HTTP/2 request processing used setString() on requestURI, causing path parameters (e.g., ;jsessionid=...) to be ignored and bypassing security constraints/directory traversal protections. The fix was applied in upstream commit cf181edc9a (May 2017) by Apache committer Mark Thomas, which changed the code to use setBytes() with ISO-8859-1 encoding to ensure proper path parameter parsing. This fix was already present in the upstream release 9.0.0.M22+ that TuxCare onboarded for version 9.0.83, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit in HEAD's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:003464c8-2cd4-50e3-89f4-26afe286ea02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 9.0.83. The vulnerability (SSI printenv command echoing user data without escaping, leading to XSS) was fixed by upstream commit 15fcd166ea on 2019-03-11 by Mark Thomas (markt@apache.org). This fix was already present in the Apache Tomcat 9.0.83 release before TuxCare onboarded it. The current code applies HTML entity encoding via SSIMediator.ENCODING_ENTI...", "justification": "code_not_present" } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:e996b76d-260d-5a7d-895c-3313079a4740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 affected Apache Tomcat versions 9.0.28-9.0.30 due to a regression in Transfer-Encoding header parsing. The target version 9.0.83 (released November 2023) is NOT affected because the upstream fix was applied in December 2019, nearly 4 years before this version was released. The fix properly rejects invalid Transfer-Encoding headers instead of silently ignoring them, preventing HTT...", "justification": "code_not_present" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:001258f1-e474-503a-bf0c-c0619bce5da9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11996 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.83 is not affected by CVE-2020-11996. The vulnerability (high CPU usage from inefficient iteration over large HTTP/2 stream ID gaps) was fixed upstream in commit 9a0231683a, Fix BZ 64467 Improve performance of closing idle streams, which shipped in Tomcat 9.0.36 in June 2020. The target version 9.0.83 naturally includes this upstream vendor fix. The vulnerable sequential iteration through stream IDs has been replaced with an optimized ConcurrentNavigableMap.subMap() approach in Http2UpgradeHandler.closeIdleStreams that only iterates over actually-existing streams, preventing CPU exhaustion attacks. The CVE affected versions 9.0.0.M1 to 9.0.35; version 9.0.83 is well beyond the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:17bf0ce4-3568-576b-9cae-c49f72578d2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2020-13934 is not present in Tomcat 9.0.83-tuxcare.5. The vulnerability affects Tomcat 9.0.0.M5 to 9.0.36 where h2c direct connections did not release the HTTP/1.1 processor after upgrading to HTTP/2, causing memory exhaustion. The upstream Apache fix (commit 172977f0 by Mark Thomas, released in 9.0.37) that adds release(processor) before creating the upgrade processor is already present in the target at AbstractProtocol.java lines 945-946. Since version 9.0.83 is well after the affected range and inherits the vendor fix from upstream, the target is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:b18a0293-414b-5d88-8438-d89de8967d43", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13935 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 9.0.83-tuxcare.6) is not affected by CVE-2020-13935. The vulnerability fix was already present in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded. The fix (commit 40fa74c74822711ab878079d0a69f7357926723d by Mark Thomas) validates that 64-bit WebSocket payload lengths are non-negative, preventing the infinite loop DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).", "justification": "code_not_present" } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:ca87a0a7-71e4-5d23-be02-0fa6eabf06f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1935 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 is NOT present in Tomcat 9.0.83. The vulnerability was fixed in upstream Apache Tomcat 9.0.31 (commit 8bfb0ff7f25fe7555a5eb2f7984f73546c11aa26 by Mark Thomas) and this fix was included in the upstream 9.0.83 release that TuxCare onboarded. The target contains the complete fix: strict CRLF validation (requiring CR to be followed by LF) and control character rejection (except TAB) i...", "justification": "code_not_present" } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:a3feae3b-f57c-517f-9dea-7856e110f04d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.83-tuxcare.7." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:2af6aaef-d440-5029-890e-b7988b772e49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. Target Apache Tomcat 9.0.83 is not affected by CVE-2021-30639. The vulnerability (missing errorException reset in Request.recycle() causing persistent error state and DoS) was fixed by upstream Apache in commit 8ece47c4a9 (March 24, 2021) by Mark Thomas. The fix is present at Request.java:754. Version 9.0.83 (released November 2023) includes this fix, which predates TuxCare maintenance (started August 2025). This is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:1b36e027-2172-539b-ace4-a6197faa5eaf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30640 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.83 is not affected by CVE-2021-30640. The vulnerability (LDAP injection via unescaped usernames in JNDI Realm) was fixed by Apache in version 9.0.46 (April 2021). The target version 9.0.83 already contains the upstream fix, including complete implementations of doAttributeValueEscaping() and doFilterEscaping() methods that prevent LDAP injection by escaping special characters ...", "justification": "code_not_present" } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:2d3e0e0b-c60d-5279-be95-461c8475b3e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33037 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.83 is not affected by CVE-2021-33037. All three required fixes for the HTTP request smuggling vulnerability are present in the target code. The CVE affects versions 9.0.0.M1 to 9.0.46; the fixes were introduced in upstream Apache Tomcat 9.0.47 (commit a2c3dc4c96 by Mark Thomas), and the target version 9.0.83 shipped with these fixes already included in the upstream release.", "justification": "code_not_present" } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:d2307021-153c-5d65-a116-fcefcc0fbb28", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41079 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2021-41079 affects Apache Tomcat 9.0.0-M1 to 9.0.43. The target repository is version 9.0.83, which is based on the upstream release that already contains the fix. The vulnerable pattern (infinite loop via `break` statement when bytesRead==0) was replaced with exception throwing in upstream commit 19ac462da8 (March 2021), well before the 9.0.83 release (November 2023). Both infinite loop mitigations (idx==endOffset check and bytesRead==0 check with exception) are present at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).", "justification": "code_not_present" } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:3799dc52-ffdc-5e89-9491-12ba77443231", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.83-tuxcare.5 is NOT vulnerable to CVE-2021-42340. The memory leak vulnerability affecting WebSocket connections was fixed by upstream Apache in commit 80f1438ec45 (2021-09-27) and is already present in the base Apache Tomcat 9.0.83 release (2023-11-09) that TuxCare's version is built upon. The vulnerable code pattern (missing WebConnection storage and cleanup) does not exist in the target. The fix properly stores the WebConnection reference during init() and closes/nulls it in destroy(), preventing the memory leak.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:d73131df-2b2a-593a-a882-a88d7fa0a5f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 9.0.83 is not affected by CVE-2021-43980. The vulnerability was fixed in upstream Apache Tomcat 9.0.61 (commit 170e0f792b by Mark Thomas), which is already included in the 9.0.83 codebase. The fix uses AtomicReference and atomic getAndSet operations to ensure exclusive processor ownership, preventing concurrent threads from sharing Http11Processor instances that would cause re...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:e66c32fb-f125-5ed5-8851-690cb164cee5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23181 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2022-23181 (TOCTOU vulnerability in FileStore session persistence) is not present in Apache Tomcat 9.0.83. The fix was included in the upstream Apache Tomcat 9.0.83 release. The vulnerable code pattern (calling getCanonicalFile() twice - once for validation, once implicitly when using the non-canonical File object) has been replaced with the secure pattern (compute canonical file once, validate it, return it). Fix commit 1385c624b4a1e994426e810075c850edc38a700e by Mark Thomas (markt@apache.org) predates the first TuxCare commit in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).", "justification": "code_not_present" } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:b73150a4-7b0b-5a0e-928e-557108fc6320", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25762 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. Target Tomcat 9.0.83 is not affected by CVE-2022-25762. The vulnerability, which allowed WebSocket messages sent during connection closure to cause pooled socket objects to be returned to the pool multiple times (leading to data delivered to wrong recipients), was fixed in upstream Apache Tomcat commit c2d6278b33 (May 2019, author remm@apache.org). This fix introduced CLOSED_NIO_CHANNEL - a dummy channel object that replaces closed sockets and throws ClosedChannelException on any I/O operation, preventing use-after-close. The fix shipped in the upstream 9.0.83 release before TuxCare onboarded it. The target contains all fix components: CLOSED_NIO_CHANNEL in NioChannel.java (lines 249-293), checks in NioEndpoint.java (lines 1280, 1303, 1395), refactored WebSocket write handling in WsRemoteEndpointImplServer.java (lines 145-229), and centralized processor management in SocketWrapperBase.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).", "justification": "code_not_present" } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:6ec4c3f6-fa41-5c13-b400-0f8c611d555d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-29885 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only CVE about misleading text that incorrectly stated EncryptInterceptor enables safe Tomcat clustering over untrusted networks. The target version 9.0.83 contains the corrected documentation that explicitly warns EncryptInterceptor only provides confidentiality and integrity protection, NOT protection against DoS and all untrusted network risks. The fix was authored by Mark Thomas (markt@apache.org) and shipped in upstream Apache Tomcat 9.0.63, which is prior to the target version 9.0.83.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).", "justification": "code_not_present" } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:ab03a22b-3646-5b63-8194-5bff9a5acae8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 fixed upstream before 9.0.83: CVE-2022-34305 fix 8b60af90b999 by markt@apache.org (2022-06-23) is an ancestor of tuxcare-current/9.0.83 (inside upstream tag 9.0.83); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commits VC credited are backports for other CVEs on the same branch. Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:2621892f-115b-504a-9a50-8a714a48fcc1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41080 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect in FORM authentication) is NOT present in the target. The vulnerability was already fixed in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The fix commit 77c0ce2d16 by Mark Thomas (markt@apache.org) was applied on 2023-08-22, before the 9.0.83 release tag on 2023-11-09. The fix is present at FormAuthenticator.java:761-764, which s...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:f3855803-bc3f-5ea5-ba13-82de83e188ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec...", "justification": "code_not_present" } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:2cd3c266-e471-53de-9f6c-c3fece3f0f15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ...", "justification": "code_not_present" } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:e4490396-7b00-5630-9882-1f5beacddf8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-54677 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:a24953f0-4936-5db7-9b18-a48cdf774a5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:29abd7ca-db02-59d7-be89-3293478bfb53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:91090b6e-7716-5a58-a9ec-7372a896cbce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:d36eff6f-9c46-5d9d-91a2-cf28453318f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:6032fdfe-b309-560f-b21c-37e7e7796ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:c6c0df9d-75c6-5d78-b89b-965fe59ba4c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:b97f29cb-f964-55c1-93d2-1f2fccaea749", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.83 is NOT AFFECTED by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved due to using HashSet instead of LinkedHashSet when merging TLS 1.3 cipher suites with regular ciphers. However, version 9.0.83 does not contain the vulnerable code pattern because TLS 1.3 cipher suite merging functionality was introduced after this version, around 9.0....", "justification": "code_not_present" } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:213d193d-2da1-5f7a-bf05-3eb664a76b07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29145 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:ac35f001-40c2-5e3f-a124-c4a16369ccbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:9714db66-1bfb-5cf8-a02d-2c77c0b89576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:527d4d7e-6b4a-5e3c-a869-378c71416f29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:4f6239d6-2400-5139-b48f-bb6cc0ef052f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34486 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:b3826bc7-2eed-5c2c-a085-2e8dbe4f54fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:5b0209a7-eb10-59ba-bbd6-5e1a110ee724", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:b4ceb482-d42f-5fa1-b896-b6ddce854d5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:e16c7c36-718b-560e-86ce-857010a359b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:824441d6-9a6b-5603-8ca8-fb03728f8ca8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43512 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:df16fdbc-230e-5db6-a00a-eace1b4fee7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:efe46ccc-6d01-52f7-a5a7-87b93875a0df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:615e81b5-d92a-54eb-a56e-f3eac4d7d8f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-50229", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:daea6677-b162-5480-8749-e93c030378cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50229 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:868d0c64-bad4-545e-ac4d-4d4fe834d32f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55276", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:0abbb49a-fc9f-5ca1-b2b7-0474f72d1c4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55276 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55955", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:3c7692b5-b75e-5de0-a278-6f0123a502a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55955 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:79ddf3a7-4e8e-5e8c-9998-3a588aa2a596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:3e43f52b-77ce-5373-aa4c-7c73a1d9e916", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:ffbcd9af-6e3a-51bd-9358-6efcbcb54dba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:8fe1dc6a-fcd3-5641-9eff-e65432626482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ], "bom-ref": "urn:uuid:0db4eec6-218c-5566-af4f-01b2d4baa9a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.83-tuxcare.7 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.7" } ] }