{
  "@id": "urn:uuid:1018f32e-9781-444a-a261-7007f9f5d96b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T09:36:43.630658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is NOT present in Tomcat 10.1.16. The XSS vulnerability via unescaped name parameter in host-manager was fixed by Apache upstream in June 2008, with escaping logic refactored to a centralized Escape utility in October 2017. The target version 10.1.16 (released November 2023) includes this upstream fix. All user input in HTMLHostManagerServlet is properly escaped using Escape.htmlE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is NOT present in Tomcat 10.1.16. The XSS vulnerability via unescaped name parameter in host-manager was fixed by Apache upstream in June 2008, with escaping logic refactored to a centralized Escape utility in October 2017. The target version 10.1.16 (released November 2023) includes this upstream fix. All user input in HTMLHostManagerServlet is properly escaped using Escape.htmlE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 describes a denial-of-service vulnerability in Apache Tomcat 8.x before 8.0.4 where AJP requests with Content-Length: 0 caused thread consumption by triggering a hang in request processing. The target version (Apache Tomcat 10.1.16) is NOT affected because the fix was already present in the upstream release 10.1.16 that TuxCare onboarded. The fix commit (8884dae60ac by Mark Thomas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 describes a denial-of-service vulnerability in Apache Tomcat 8.x before 8.0.4 where AJP requests with Content-Length: 0 caused thread consumption by triggering a hang in request processing. The target version (Apache Tomcat 10.1.16) is NOT affected because the fix was already present in the upstream release 10.1.16 that TuxCare onboarded. The fix commit (8884dae60ac by Mark Thomas..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.16 is NOT AFFECTED by CVE-2017-12615. The vulnerable JNDI-based FileDirContext/VirtualDirContext architecture from Tomcat 7.x does not exist in Tomcat 10.x. The modern WebResourceRoot architecture includes built-in Windows filename validation (isInvalidWindowsFilename method and canonical path checks) that blocks the trailing-space exploitation technique. This defense was added by Apache upstream in September 2017 (commit a9dd96046d by Mark Thomas) and was already present in the upstream Tomcat 10.1.16 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Tomcat 10.1.16 is NOT AFFECTED by CVE-2017-12615. The vulnerable JNDI-based FileDirContext/VirtualDirContext architecture from Tomcat 7.x does not exist in Tomcat 10.x. The modern WebResourceRoot architecture includes built-in Windows filename validation (isInvalidWindowsFilename method and canonical path checks) that blocks the trailing-space exploitation technique. This defense was added by Apache upstream in September 2017 (commit a9dd96046d by Mark Thomas) and was already present in the upstream Tomcat 10.1.16 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is not present in Tomcat 10.1.16. The vulnerability allowed uploading JSP files via specially crafted HTTP PUT requests using trailing slash path manipulation. The upstream Apache Tomcat project fixed this in September 2017 (commits b7e0435d17 and b577f9a799). These fixes were already included in the upstream 10.1.16 release that TuxCare onboarded. The vulnerable pattern is not present because the upstream vendor's fix was already applied before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is not present in Tomcat 10.1.16. The vulnerability allowed uploading JSP files via specially crafted HTTP PUT requests using trailing slash path manipulation. The upstream Apache Tomcat project fixed this in September 2017 (commits b7e0435d17 and b577f9a799). These fixes were already included in the upstream 10.1.16 release that TuxCare onboarded. The vulnerable pattern is not present because the upstream vendor's fix was already applied before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Tomcat 10.1.16. The vulnerability involved passing internal Request/Response objects to application listeners instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The fix (using request.getRequest() to obtain facades) was applied upstream by Apache Tomcat developer Mark Thomas in March 2017 (commit dfa40863) and shipped in the upstream Tomcat 10.1.16 release. All critical code locations in the target use facades correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is NOT present in Tomcat 10.1.16. The vulnerability involved passing internal Request/Response objects to application listeners instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The fix (using request.getRequest() to obtain facades) was applied upstream by Apache Tomcat developer Mark Thomas in March 2017 (commit dfa40863) and shipped in the upstream Tomcat 10.1.16 release. All critical code locations in the target use facades correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 affected Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 due to a regression in HTTP connector refactoring where sendfile processing completing quickly could cause a Processor to be added to the processor cache twice, leading to the same Processor being used for multiple requests and causing response mix-up. The target version is Tomcat 10.1.16. The vulnerability fix (bug 60918) was applied by Mark Thomas (markt@apache.org) in March 2017 to the Tomcat 9.x codebase. Tomcat 10.x, released in 2020, inherited this fix from Tomcat 9.x. Analysis confirms all fix patterns are present in the target code: SendfileState enum tracking, processSendfile() method returning SendfileState, loop condition checking sendfileState == SendfileState.DONE, and removal of premature sendfileData clearing. The fix commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 is an ancestor of HEAD and was present in the upstream Tomcat 10.1.16 release before TuxCare onboarded it (first TuxCare commit: e1463febbc3e1eee03c0ab70053f4c612e8a66e0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 affected Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 due to a regression in HTTP connector refactoring where sendfile processing completing quickly could cause a Processor to be added to the processor cache twice, leading to the same Processor being used for multiple requests and causing response mix-up. The target version is Tomcat 10.1.16. The vulnerability fix (bug 60918) was applied by Mark Thomas (markt@apache.org) in March 2017 to the Tomcat 9.x codebase. Tomcat 10.x, released in 2020, inherited this fix from Tomcat 9.x. Analysis confirms all fix patterns are present in the target code: SendfileState enum tracking, processSendfile() method returning SendfileState, loop condition checking sendfileState == SendfileState.DONE, and removal of premature sendfileData clearing. The fix commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 is an ancestor of HEAD and was present in the upstream Tomcat 10.1.16 release before TuxCare onboarded it (first TuxCare commit: e1463febbc3e1eee03c0ab70053f4c612e8a66e0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784: The target Apache Tomcat 10.1.16 is NOT AFFECTED. The vulnerability involves crafting URLs with multiple leading slashes (e.g., \"//evil.com/path\") that cause protocol-relative redirects to attacker-controlled domains when the DefaultServlet redirects from a directory path without a trailing slash. The fix (a while loop that removes extra leading slashes before sending redirects)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784: The target Apache Tomcat 10.1.16 is NOT AFFECTED. The vulnerability involves crafting URLs with multiple leading slashes (e.g., \"//evil.com/path\") that cause protocol-relative redirects to attacker-controlled domains when the DefaultServlet redirects from a directory path without a trailing slash. The fix (a while loop that removes extra leading slashes before sending redirects)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304: Target Tomcat 10.1.16 is not affected. The vulnerability (security constraint bypass when URL pattern is empty string \"\") was fixed by Apache upstream in commit 723ea6a5bc (Feb 2018) and was already present in the upstream Tomcat 10.1.16 release that TuxCare onboarded. The vulnerable pattern does not exist in the target - both fix components are present: (1) empty string URI norm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304: Target Tomcat 10.1.16 is not affected. The vulnerability (security constraint bypass when URL pattern is empty string \"\") was fixed by Apache upstream in commit 723ea6a5bc (Feb 2018) and was already present in the upstream Tomcat 10.1.16 release that TuxCare onboarded. The vulnerable pattern does not exist in the target - both fix components are present: (1) empty string URI norm..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is not present in Tomcat 10.1.16. The vulnerability involved security constraints from @ServletSecurity annotations being applied lazily at servlet load time rather than at application startup, allowing servlet load order to determine whether constraints were enforced. The fix (commit 3e54b2a631 from Feb 2018 by Apache's Mark Thomas) was already included in the upstream Tomcat 10....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is not present in Tomcat 10.1.16. The vulnerability involved security constraints from @ServletSecurity annotations being applied lazily at servlet load time rather than at application startup, allowing servlet load order to determine whether constraints were enforced. The fix (commit 3e54b2a631 from Feb 2018 by Apache's Mark Thomas) was already included in the upstream Tomcat 10...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.16 is NOT AFFECTED by CVE-2018-1336. The vulnerable custom Utf8Decoder.java class does not exist in this version. Apache Tomcat removed the custom UTF-8 decoder entirely in April 2022 (commit a9ca10266b) and replaced it with Java's standard CharsetDecoder, which does not have the infinite loop vulnerability. This architectural change was included in the upstream release before version 10.1.16 was onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Tomcat 10.1.16 is NOT AFFECTED by CVE-2018-1336. The vulnerable custom Utf8Decoder.java class does not exist in this version. Apache Tomcat removed the custom UTF-8 decoder entirely in April 2022 (commit a9ca10266b) and replaced it with Java's standard CharsetDecoder, which does not have the infinite loop vulnerability. This architectural change was included in the upstream release before version 10.1.16 was onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 is not present in Tomcat 10.1.16. The vulnerability concerned insecure CORS filter defaults (allowedOrigins=\"*\" + supportsCredentials=\"true\"). The upstream fix (commit d83a76732e by Mark Thomas) changed these defaults to secure values (allowedOrigins=\"\", supportsCredentials=\"false\") and added validation to reject the insecure combination. This fix was already present in the upstream Tomcat 10.1.16 release that TuxCare onboarded, prior to any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 is not present in Tomcat 10.1.16. The vulnerability concerned insecure CORS filter defaults (allowedOrigins=\"*\" + supportsCredentials=\"true\"). The upstream fix (commit d83a76732e by Mark Thomas) changed these defaults to secure values (allowedOrigins=\"\", supportsCredentials=\"false\") and added validation to reject the insecure combination. This fix was already present in the upstream Tomcat 10.1.16 release that TuxCare onboarded, prior to any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 is NOT present in Apache Tomcat 10.1.16. The vulnerability (missing hostname verification in WebSocket TLS client connections) was fixed by upstream Apache in June 2018 (commit 2835bb4e03) and shipped in all releases after Tomcat 9.0.9. Version 10.1.16 is a much newer release that already includes the fix. The target code at WsWebSocketContainer.java:949-955 unconditionally enables hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"), preventing man-in-the-middle attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 is NOT present in Apache Tomcat 10.1.16. The vulnerability (missing hostname verification in WebSocket TLS client connections) was fixed by upstream Apache in June 2018 (commit 2835bb4e03) and shipped in all releases after Tomcat 9.0.9. Version 10.1.16 is a much newer release that already includes the fix. The target code at WsWebSocketContainer.java:949-955 unconditionally enables hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"), preventing man-in-the-middle attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 (async timeout race condition causing cross-user response confusion) is not present in the target. The vulnerability involved stale async timeout events processing against wrong request contexts when async requests completed simultaneously with container timeouts. The upstream Apache fixes shipped in Tomcat 10.1.16 (onboarded by TuxCare) and include: (1) generation tracking to det...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 (async timeout race condition causing cross-user response confusion) is not present in the target. The vulnerability involved stale async timeout events processing against wrong request contexts when async requests completed simultaneously with container timeouts. The upstream Apache fixes shipped in Tomcat 10.1.16 (onboarded by TuxCare) and include: (1) generation tracking to det..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 is not present in Apache Tomcat 10.1.16-tuxcare.1. All three defense mechanisms (stream read timeout, stream write timeout, and overhead frame tracking) were added by upstream Apache Tomcat in February 2019 (commits c38033338a and f9d8c2591f by Mark Thomas) and are part of the upstream 10.1.16 release that TuxCare onboarded. The vulnerable pattern (missing timeouts and unlimited overhead frame acceptance) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 is not present in Apache Tomcat 10.1.16-tuxcare.1. All three defense mechanisms (stream read timeout, stream write timeout, and overhead frame tracking) were added by upstream Apache Tomcat in February 2019 (commits c38033338a and f9d8c2591f by Mark Thomas) and are part of the upstream 10.1.16 release that TuxCare onboarded. The vulnerable pattern (missing timeouts and unlimited overhead frame acceptance) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command in Apache Tomcat, which echoed environment variable values without HTML entity encoding, enabling XSS attacks. The target repository (Tomcat 10.1.16-tuxcare.1) already contains the upstream fix introduced by Mark Thomas (markt@apache.org) in commit 15fcd166 on March 11, 2019. The fix adds HTML entity encoding via the SSIMediator.ENCODING_ENTITY par...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command in Apache Tomcat, which echoed environment variable values without HTML entity encoding, enabling XSS attacks. The target repository (Tomcat 10.1.16-tuxcare.1) already contains the upstream fix introduced by Mark Thomas (markt@apache.org) in commit 15fcd166 on March 11, 2019. The fix adds HTML entity encoding via the SSIMediator.ENCODING_ENTITY par..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.16 is not affected by CVE-2019-0232. The vulnerability affected Tomcat versions 9.0.0.M1-9.0.17, 8.5.0-8.5.39, and 7.0.0-7.0.93. The target version 10.1.16 already contains the upstream fix (commit 4b244d827a by Mark Thomas) that validates decoded CGI command line arguments against a restrictive pattern on Windows. This fix was shipped in the upstream Apache Tomcat release before TuxCare onboarded version 10.1.16. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "Apache Tomcat 10.1.16 is not affected by CVE-2019-0232. The vulnerability affected Tomcat versions 9.0.0.M1-9.0.17, 8.5.0-8.5.39, and 7.0.0-7.0.93. The target version 10.1.16 already contains the upstream fix (commit 4b244d827a by Mark Thomas) that validates decoded CGI command line arguments against a restrictive pattern on Windows. This fix was shipped in the upstream Apache Tomcat release before TuxCare onboarded version 10.1.16. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 is NOT present in Tomcat 10.1.16. The vulnerability fix was already included in the upstream Apache Tomcat 10.1.16 release that TuxCare onboarded. Commit 7f748eb6bf (authored by Mark Thomas, Apache upstream) added timeout handling to connection window exhaustion, preventing indefinite thread blocking. The code has since been refactored (commit e633e73d61) to use WindowAllocationManager, but the timeout protection mechanism remains fully functional. Both the original fix and the refactoring are from upstream Apache and were present before TuxCare's first commit (e1463febbc - Onboard version 10.1.16).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "CVE-2019-10072 is NOT present in Tomcat 10.1.16. The vulnerability fix was already included in the upstream Apache Tomcat 10.1.16 release that TuxCare onboarded. Commit 7f748eb6bf (authored by Mark Thomas, Apache upstream) added timeout handling to connection window exhaustion, preventing indefinite thread blocking. The code has since been refactored (commit e633e73d61) to use WindowAllocationManager, but the timeout protection mechanism remains fully functional. Both the original fix and the refactoring are from upstream Apache and were present before TuxCare's first commit (e1463febbc - Onboard version 10.1.16).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Version 10.1.16 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was completely removed by upstream Apache Tomcat in commit 46fbf32e55 dated 2020-01-15, years before version 10.1.16 was released (2023-11-10). The component that created mutable RMI registries susceptible to man-in-the-middle attacks no longer exists in this version. Exhaustive search confirms no alternative JMX remote implementation with the vulnerable pattern exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "Version 10.1.16 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was completely removed by upstream Apache Tomcat in commit 46fbf32e55 dated 2020-01-15, years before version 10.1.16 was released (2023-11-10). The component that created mutable RMI registries susceptible to man-in-the-middle attacks no longer exists in this version. Exhaustive search confirms no alternative JMX remote implementation with the vulnerable pattern exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 (session fixation in FORM authentication) does not affect Tomcat 10.1.16. The vulnerability existed in Tomcat 7.x, 8.x, and 9.x where principal was temporarily stored in session notes (FORM_PRINCIPAL_NOTE) creating a session fixation window. Apache Tomcat fixed this in December 2019 for versions 7.0.99, 8.5.50, and 9.0.30. Tomcat 10.0.0-M1 was released in February 2020 (after the fix) and never contained the vulnerable code pattern. Target version 10.1.16 shipped with the fix from upstream - it uses the safe pattern of calling register() immediately after authentication, never uses FORM_PRINCIPAL_NOTE, and checks cached authentication after request matching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 (session fixation in FORM authentication) does not affect Tomcat 10.1.16. The vulnerability existed in Tomcat 7.x, 8.x, and 9.x where principal was temporarily stored in session notes (FORM_PRINCIPAL_NOTE) creating a session fixation window. Apache Tomcat fixed this in December 2019 for versions 7.0.99, 8.5.50, and 9.0.30. Tomcat 10.0.0-M1 was released in February 2020 (after the fix) and never contained the vulnerable code pattern. Target version 10.1.16 shipped with the fix from upstream - it uses the safe pattern of calling register() immediately after authentication, never uses FORM_PRINCIPAL_NOTE, and checks cached authentication after request matching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 10.1.16 is NOT affected by CVE-2019-17569. The vulnerability affected only versions 9.0.28-30, 8.5.48-50, and 7.0.98-99 due to a regression in Transfer-Encoding header validation. The fix (commit 3c295d913e by Mark Thomas) was applied upstream on Dec 17, 2019 and was already present in the upstream Tomcat 10.1.16 release when TuxCare onboarded it. The current code properly validates Tran...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Tomcat 10.1.16 is NOT affected by CVE-2019-17569. The vulnerability affected only versions 9.0.28-30, 8.5.48-50, and 7.0.98-99 due to a regression in Transfer-Encoding header validation. The fix (commit 3c295d913e by Mark Thomas) was applied upstream on Dec 17, 2019 and was already present in the upstream Tomcat 10.1.16 release when TuxCare onboarded it. The current code properly validates Tran..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.16 is not affected by CVE-2020-11996. The vulnerable algorithmic complexity pattern never existed in the 10.1.x branch. The target uses streams.subMap() to efficiently iterate only over actual existing streams between two stream IDs, preventing the unbounded loop attack that could cause CPU exhaustion with large stream IDs. This safe implementation was present from the first 10.1.x release (10.1.0, September 2022), over 2 years after the CVE was fixed in May 2020.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Tomcat 10.1.16 is not affected by CVE-2020-11996. The vulnerable algorithmic complexity pattern never existed in the 10.1.x branch. The target uses streams.subMap() to efficiently iterate only over actual existing streams between two stream IDs, preventing the unbounded loop attack that could cause CPU exhaustion with large stream IDs. This safe implementation was present from the first 10.1.x release (10.1.0, September 2022), over 2 years after the CVE was fixed in May 2020.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Version 10.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-qxf4-chvg-4r8r (affected below 9.0.31), NVD (affected up to 9.0.30), CVE record (affected up to 9.0.30), Snyk (affected below 9.0.31).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "Version 10.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-qxf4-chvg-4r8r (affected below 9.0.31), NVD (affected up to 9.0.30), CVE record (affected up to 9.0.30), Snyk (affected below 9.0.31)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Apache Tomcat 10.1.16. The vulnerability allowed attackers to read arbitrary files and process them as JSP via crafted AJP requests with arbitrary attribute names. The upstream fix (commit aba0c9a488 by markt@apache.org) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it (commit e1463febbc by ikashchyeyev@cloudlinux.com). The fix implements three defenses: (1) AJP binds to loopback-only by default, (2) secret authentication is required, and (3) arbitrary request attributes are rejected with HTTP 403. Additionally, the AJP connector is disabled (commented out) in the default server.xml configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Apache Tomcat 10.1.16. The vulnerability allowed attackers to read arbitrary files and process them as JSP via crafted AJP requests with arbitrary attribute names. The upstream fix (commit aba0c9a488 by markt@apache.org) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it (commit e1463febbc by ikashchyeyev@cloudlinux.com). The fix implements three defenses: (1) AJP binds to loopback-only by default, (2) secret authentication is required, and (3) arbitrary request attributes are rejected with HTTP 403. Additionally, the AJP connector is disabled (commented out) in the default server.xml configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.16 is NOT affected by CVE-2020-9484. The vulnerability involves a path traversal attack in FileStore that allows loading and deserializing arbitrary files via manipulated session IDs. The fix adding canonical path validation was already present in the Apache Tomcat 10.1.16 upstream release that TuxCare onboarded. The defense code at FileStore.java:347-350 validates that resolved file paths remain within the storage directory boundary, blocking the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Apache Tomcat 10.1.16 is NOT affected by CVE-2020-9484. The vulnerability involves a path traversal attack in FileStore that allows loading and deserializing arbitrary files via manipulated session IDs. The fix adding canonical path validation was already present in the Apache Tomcat 10.1.16 upstream release that TuxCare onboarded. The defense code at FileStore.java:347-350 validates that resolved file paths remain within the storage directory boundary, blocking the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 does not affect Apache Tomcat 10.1.16. The vulnerability, which allowed JSP source code disclosure on Windows/NTFS due to inconsistent File.getCanonicalPath() behavior with colon characters in filenames, was fixed in the upstream Apache Tomcat release. The fix (adding ':' to the invalid Windows filename character check) is present in AbstractFileResourceSet.java at line 172. This...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 does not affect Apache Tomcat 10.1.16. The vulnerability, which allowed JSP source code disclosure on Windows/NTFS due to inconsistent File.getCanonicalPath() behavior with colon characters in filenames, was fixed in the upstream Apache Tomcat release. The fix (adding ':' to the invalid Windows filename character check) is present in AbstractFileResourceSet.java at line 172. This..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 affects Apache Tomcat when responding to h2c (HTTP/2 cleartext) connections due to concurrency issues that could cause request data from one user to leak into another user's request. The target version 10.1.16 is not vulnerable because all upstream fixes were already present in the Apache Tomcat 10.1.16 release that TuxCare onboarded. The fixes include: (1) HpackDecoder using local StringBuilder instead of shared instance field, (2) ConnectionSettingsBase using ConcurrentHashMap instead of EnumMap for thread safety, and (3) AbstractProtocol properly ordering leftover input restoration before upgrade processor creation. All fix commits are authored by Mark Thomas (markt@apache.org) from Apache upstream and predate TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 affects Apache Tomcat when responding to h2c (HTTP/2 cleartext) connections due to concurrency issues that could cause request data from one user to leak into another user's request. The target version 10.1.16 is not vulnerable because all upstream fixes were already present in the Apache Tomcat 10.1.16 release that TuxCare onboarded. The fixes include: (1) HpackDecoder using local StringBuilder instead of shared instance field, (2) ConnectionSettingsBase using ConcurrentHashMap instead of EnumMap for thread safety, and (3) AbstractProtocol properly ordering leftover input restoration before upgrade processor creation. All fix commits are authored by Mark Thomas (markt@apache.org) from Apache upstream and predate TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 (incomplete fix for CVE-2020-9484) is not present in Tomcat 10.1.16. The vulnerability involved string-based canonical path comparison that could be bypassed through filesystem edge cases. Apache Tomcat fixed this in commit 6d66e99ef8 (2021-01-20) by replacing String.startsWith() with java.nio.file.Path.startsWith() for consistent sub-directory checking. This fix was included in upstream Tomcat 10.0.1 and all subsequent versions including 10.1.16. All five affected files (FileStore.java, ExpandWar.java, DefaultServlet.java, HostConfig.java, ContextConfig.java) contain the Path-based validation fix. No vulnerable string-based patterns remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 (incomplete fix for CVE-2020-9484) is not present in Tomcat 10.1.16. The vulnerability involved string-based canonical path comparison that could be bypassed through filesystem edge cases. Apache Tomcat fixed this in commit 6d66e99ef8 (2021-01-20) by replacing String.startsWith() with java.nio.file.Path.startsWith() for consistent sub-directory checking. This fix was included in upstream Tomcat 10.0.1 and all subsequent versions including 10.1.16. All five affected files (FileStore.java, ExpandWar.java, DefaultServlet.java, HostConfig.java, ContextConfig.java) contain the Path-based validation fix. No vulnerable string-based patterns remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 affects Apache Tomcat versions 8.5.0-8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, and 10.1.0-M1 to 10.1.0. The target repository is at version 10.1.16, which is higher than the affected range (10.1.0). The vulnerability involved Tomcat accepting HTTP requests with malformed Content-Length headers when rejectIllegalHeader was set to false, enabling request smuggling attacks. The fix (commit c9fe754e5d by Mark Thomas, Oct 3 2022) adds special logic to Http11InputBuffer.skipLine() that forces rejection of any Content-Length header containing invalid characters, regardless of the rejectIllegalHeader configuration. This upstream fix was already present in Apache Tomcat 10.1.16 when TuxCare onboarded it (commit e1463febbc3e by ikashchyeyev@cloudlinux.com). The target is not affected because the vulnerable code pattern was removed by the upstream vendor before the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "CVE-2022-42252 affects Apache Tomcat versions 8.5.0-8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, and 10.1.0-M1 to 10.1.0. The target repository is at version 10.1.16, which is higher than the affected range (10.1.0). The vulnerability involved Tomcat accepting HTTP requests with malformed Content-Length headers when rejectIllegalHeader was set to false, enabling request smuggling attacks. The fix (commit c9fe754e5d by Mark Thomas, Oct 3 2022) adds special logic to Http11InputBuffer.skipLine() that forces rejection of any Content-Length header containing invalid characters, regardless of the rejectIllegalHeader configuration. This upstream fix was already present in Apache Tomcat 10.1.16 when TuxCare onboarded it (commit e1463febbc3e by ikashchyeyev@cloudlinux.com). The target is not affected because the vulnerable code pattern was removed by the upstream vendor before the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-45143 is not present in Apache Tomcat 10.1.16. The vulnerability concerns missing escaping in JsonErrorReportValve that could allow JSON injection. The fix was already included in the upstream Apache Tomcat 10.1.16 release that TuxCare onboarded. The JsonErrorReportValve.java file at lines 86-88 properly uses JSONFilter.escape() to escape type, message, and description fields before embedding them in JSON output, preventing JSON injection and malformed output. The fix commit (1f50bff8daabb48c5f15398689988f26aac6ec56) was authored by Mark Thomas (markt@apache.org) and is an ancestor of TuxCare's onboarding commit (e1463febbc), confirming it shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 is not present in Apache Tomcat 10.1.16. The vulnerability concerns missing escaping in JsonErrorReportValve that could allow JSON injection. The fix was already included in the upstream Apache Tomcat 10.1.16 release that TuxCare onboarded. The JsonErrorReportValve.java file at lines 86-88 properly uses JSONFilter.escape() to escape type, message, and description fields before embedding them in JSON output, preventing JSON injection and malformed output. The fix commit (1f50bff8daabb48c5f15398689988f26aac6ec56) was authored by Mark Thomas (markt@apache.org) and is an ancestor of TuxCare's onboarding commit (e1463febbc), confirming it shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 fix was already present in upstream Apache Tomcat 10.1.16 release. The vulnerability concerns unbounded file upload part processing in Commons FileUpload. The fix adds fileCountMax enforcement to limit the number of file parts processed per request. In Tomcat 10.1.16, this defense is active by default via maxParameterCount=10000. The fix was authored by upstream Apache developer Mark Thomas and shipped with the 10.1.16 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 fix was already present in upstream Apache Tomcat 10.1.16 release. The vulnerability concerns unbounded file upload part processing in Commons FileUpload. The fix adds fileCountMax enforcement to limit the number of file parts processed per request. In Tomcat 10.1.16, this defense is active by default via maxParameterCount=10000. The fix was authored by upstream Apache developer Mark Thomas and shipped with the 10.1.16 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 is NOT present in Apache Tomcat 10.1.16. The vulnerability (an off-by-one error in parameter counting that allowed bypassing maxParameterCount when exactly that many query parameters were sent) was fixed upstream by Mark Thomas in commit ba848da71c5 on April 11, 2023, released in Tomcat 10.1.8. Since the target version 10.1.16 was released after 10.1.8, it already contains the upstream fix. The vulnerable code pattern (checking limit after incrementing counter) has been replaced with the secure pattern (checking before incrementing, using >= instead of >).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "CVE-2023-28709 is NOT present in Apache Tomcat 10.1.16. The vulnerability (an off-by-one error in parameter counting that allowed bypassing maxParameterCount when exactly that many query parameters were sent) was fixed upstream by Mark Thomas in commit ba848da71c5 on April 11, 2023, released in Tomcat 10.1.8. Since the target version 10.1.16 was released after 10.1.8, it already contains the upstream fix. The vulnerable code pattern (checking limit after incrementing counter) has been replaced with the secure pattern (checking before incrementing, using >= instead of >).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.16 is not affected by CVE-2023-34981. This CVE describes a regression in bug 66512's fix where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The fix for this regression (bug 66591) was committed upstream by Mark Thomas on May 3, 2023, and first included in Apache Tomcat 10.1.10. The target version 10.1.16 (released November 10, 2023) already contains this upstream fix in the prepareResponse() method, which uses a while loop with needAjpMessageHeader flag to ensure SEND_HEADERS is always sent regardless of header count.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "Apache Tomcat 10.1.16 is not affected by CVE-2023-34981. This CVE describes a regression in bug 66512's fix where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The fix for this regression (bug 66591) was committed upstream by Mark Thomas on May 3, 2023, and first included in Apache Tomcat 10.1.10. The target version 10.1.16 (released November 10, 2023) already contains this upstream fix in the prepareResponse() method, which uses a while loop with needAjpMessageHeader flag to ensure SEND_HEADERS is always sent regardless of header count.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Tomcat 10.1.16. The upstream Apache Tomcat fix was already included in the 10.1.16 release (Nov 2023) when TuxCare onboarded it. The defense tracks RST_STREAM frames using an overhead counter (incremented by factor 50 per RST) and closes the connection when the overhead limit is exceeded, preventing resource exhaustion from rapid stream resets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Tomcat 10.1.16. The upstream Apache Tomcat fix was already included in the 10.1.16 release (Nov 2023) when TuxCare onboarded it. The defense tracks RST_STREAM frames using an overhead counter (incremented by factor 50 per RST) and closes the connection when the overhead limit is exceeded, preventing resource exhaustion from rapid stream resets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-46589. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.15, and version 10.1.16 is the first upstream release containing the fix. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 8ecff306 on 2023-10-05 and was already present in the upstream 10.1.16 release when TuxCare onboarded it. Both the primary fix (trailer header validation in ChunkedInputFilter) and secondary defensive measure (error handling in InputBuffer) are present in the target at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "Target Apache Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-46589. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.15, and version 10.1.16 is the first upstream release containing the fix. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 8ecff306 on 2023-10-05 and was already present in the upstream 10.1.16 release when TuxCare onboarded it. Both the primary fix (trailer header validation in ChunkedInputFilter) and secondary defensive measure (error handling in InputBuffer) are present in the target at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 10.1.16 is not affected by CVE-2024-21733. The vulnerability involves generation of error messages containing sensitive information when I/O operations are attempted after connections are closed. The target already contains both upstream fixes: (1) ErrorReportValve.java checks IS_IO_ALLOWED before attempting to flush error responses (commit ce4f9a5e0e2, 2021-02-24), and (2) Http11InputBu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 Tomcat 10.1.16 is not affected by CVE-2024-21733. The vulnerability involves generation of error messages containing sensitive information when I/O operations are attempted after connections are closed. The target already contains both upstream fixes: (1) ErrorReportValve.java checks IS_IO_ALLOWED before attempting to flush error responses (commit ce4f9a5e0e2, 2021-02-24), and (2) Http11InputBu..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Version 10.1.16 is not affected by CVE-2024-52317. The vulnerability requires HTTP/2 request/response pooling and recycling mechanisms that were introduced in version 10.1.27 (July 2024). Version 10.1.16 lacks the vulnerable code pattern entirely: its Stream.recycle() method only calls handler.replaceStream() and does not recycle or pool coyoteRequest/coyoteResponse objects. The CVE's affected ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Version 10.1.16 is not affected by CVE-2024-52317. The vulnerability requires HTTP/2 request/response pooling and recycling mechanisms that were introduced in version 10.1.27 (July 2024). Version 10.1.16 lacks the vulnerable code pattern entirely: its Stream.recycle() method only calls handler.replaceStream() and does not recycle or pool coyoteRequest/coyoteResponse objects. The CVE's affected ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "action_statement": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "action_statement": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "action_statement": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "action_statement": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "action_statement": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2025-52434. The vulnerable component (APR/Native connector and AprEndpoint.java) does not exist in this version. The APR/Native connector was removed from Apache Tomcat in version 10.1.0-M5 (released September 2021), before version 10.1.16 was released. The vulnerability specifically affects the APR/Native connector's race condition handling, but version 10.1.16 only includes NIO and NIO2 connectors, making it immune to this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "impact_statement": "The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2025-52434. The vulnerable component (APR/Native connector and AprEndpoint.java) does not exist in this version. The APR/Native connector was removed from Apache Tomcat in version 10.1.0-M5 (released September 2021), before version 10.1.16 was released. The vulnerability specifically affects the APR/Native connector's race condition handling, but version 10.1.16 only includes NIO and NIO2 connectors, making it immune to this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      },
      "action_statement": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "action_statement": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "impact_statement": "Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      },
      "action_statement": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.16 does not contain the vulnerable code pattern. The CVE-2026-29129 vulnerability was introduced in later versions (10.1.51+, 9.0.114+, 11.0.16+) when TLS 1.3 cipher suite support was added via commit 4ee45c557168 on 2026-01-06. That commit introduced a bug where cipher lists were merged using HashSet (which doesn't preserve order) instead of LinkedHashSet. Version 10.1.16, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.16 does not contain the vulnerable code pattern. The CVE-2026-29129 vulnerability was introduced in later versions (10.1.51+, 9.0.114+, 11.0.16+) when TLS 1.3 cipher suite support was added via commit 4ee45c557168 on 2026-01-06. That commit introduced a bug where cipher lists were merged using HashSet (which doesn't preserve order) instead of LinkedHashSet. Version 10.1.16, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:43.630658+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:36:24.094710+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 10.1.16-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}