{
  "@id": "urn:uuid:70fd3dc0-e65e-4ad1-a118-83d5aa184527",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 61,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T16:52:53.138657+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 10.1.33. The vulnerability involved XSS via unescaped rendering of the hostname parameter in the host-manager HTML interface. The upstream fix (commit 49c71fc59c by Mark Thomas, June 2, 2008) was already present in version 10.1.33 when TuxCare onboarded it in October 2026. All user-controlled data (hostname, messages, aliases) is properly HTML-escap...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 10.1.33. The vulnerability involved XSS via unescaped rendering of the hostname parameter in the host-manager HTML interface. The upstream fix (commit 49c71fc59c by Mark Thomas, June 2, 2008) was already present in version 10.1.33 when TuxCare onboarded it in October 2026. All user-controlled data (hostname, messages, aliases) is properly HTML-escap..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:01.860590+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, where AJP requests with Content-Length: 0 caused thread hangs. The target (Tomcat 10.1.33) contains the upstream fix from 2014 that properly handles Content-Length: 0 by setting endOfStream and returning without waiting for body data. The fix was authored by upstream Apache developer Mark Thomas and was already present in the Tomcat 10.1.33 ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, where AJP requests with Content-Length: 0 caused thread hangs. The target (Tomcat 10.1.33) contains the upstream fix from 2014 that properly handles Content-Length: 0 by setting endOfStream and returning without waiting for body data. The fix was authored by upstream Apache developer Mark Thomas and was already present in the Tomcat 10.1.33 ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affects Apache Tomcat 7.0.0-7.0.79 on Windows, allowing JSP upload via specially crafted filenames (trailing spaces, NTFS alternate data streams). The target (Tomcat 10.1.33) uses a completely different architecture: the vulnerable FileDirContext/VirtualDirContext classes from Tomcat 7.x do not exist. Tomcat 10.x uses WebResourceRoot/WebResourceSet with AbstractFileResourceSet.file() that includes isInvalidWindowsFilename() validation (added by Mark Thomas in Sept 2017), which explicitly rejects filenames with trailing spaces and colon characters - the exact CVE-2017-12615 exploit vectors. This upstream fix shipped in Tomcat 10.1.33 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affects Apache Tomcat 7.0.0-7.0.79 on Windows, allowing JSP upload via specially crafted filenames (trailing spaces, NTFS alternate data streams). The target (Tomcat 10.1.33) uses a completely different architecture: the vulnerable FileDirContext/VirtualDirContext classes from Tomcat 7.x do not exist. Tomcat 10.x uses WebResourceRoot/WebResourceSet with AbstractFileResourceSet.file() that includes isInvalidWindowsFilename() validation (added by Mark Thomas in Sept 2017), which explicitly rejects filenames with trailing spaces and colon characters - the exact CVE-2017-12615 exploit vectors. This upstream fix shipped in Tomcat 10.1.33 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is NOT present in Tomcat 10.1.33. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes (e.g., \"malicious.jsp/\"), exploiting Java File API behavior that drops trailing slashes. The upstream fix (commits b7e0435d17 and b577f9a799, September 2017) was already present in Apache Tomcat 10.1.33 (released November 2024) before TuxCare onboarding. The fix rejects file operations when paths end with \"/\", preventing path manipulation. Fix authored by Mark Thomas (markt@apache.org), not TuxCare/CloudLinux. Verdict: not_affected (upstream fix in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is NOT present in Tomcat 10.1.33. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes (e.g., \"malicious.jsp/\"), exploiting Java File API behavior that drops trailing slashes. The upstream fix (commits b7e0435d17 and b577f9a799, September 2017) was already present in Apache Tomcat 10.1.33 (released November 2024) before TuxCare onboarding. The fix rejects file operations when paths end with \"/\", preventing path manipulation. Fix authored by Mark Thomas (markt@apache.org), not TuxCare/CloudLinux. Verdict: not_affected (upstream fix in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Apache Tomcat 10.1.33. The vulnerability involved application listeners receiving raw internal request/response objects instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The fix (using request.getRequest() to pass facades instead of raw objects) was applied by upstream Apache in March 2017 and is present in all affected files in version 10.1.33. When TuxCare onboarded this version, the fix was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is NOT present in Apache Tomcat 10.1.33. The vulnerability involved application listeners receiving raw internal request/response objects instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The fix (using request.getRequest() to pass facades instead of raw objects) was applied by upstream Apache in March 2017 and is present in all affected files in version 10.1.33. When TuxCare onboarded this version, the fix was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 does not affect this target. The vulnerability was fixed by Apache Tomcat in March 2017 (commit 9233d9d6a0, bug 60918) and affects only versions 8.5.0-8.5.12 and 9.0.0.M1-M18. The fix is present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. Code analysis confirms all fix components are present: SendfileState tracking variable, loop condition checking state instead of data reference, processSendfile() method returning SendfileState, and no premature clearing of sendfileData in prepareRequest().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 does not affect this target. The vulnerability was fixed by Apache Tomcat in March 2017 (commit 9233d9d6a0, bug 60918) and affects only versions 8.5.0-8.5.12 and 9.0.0.M1-M18. The fix is present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. Code analysis confirms all fix components are present: SendfileState tracking variable, loop condition checking state instead of data reference, processSendfile() method returning SendfileState, and no premature clearing of sendfileData in prepareRequest().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 10.1.33 is not affected by CVE-2018-11784. The vulnerability was fixed in the upstream Tomcat codebase on 2018-09-04 (commit efb860b3ff by Mark Thomas), and this fix was already present in the Tomcat 10.1.33 release that TuxCare onboarded on 2026-10-07. The fix prevents protocol-relative redirect attacks by removing extra leading slashes from redirect location strings i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 10.1.33 is not affected by CVE-2018-11784. The vulnerability was fixed in the upstream Tomcat codebase on 2018-09-04 (commit efb860b3ff by Mark Thomas), and this fix was already present in the Tomcat 10.1.33 release that TuxCare onboarded on 2026-10-07. The fix prevents protocol-relative redirect attacks by removing extra leading slashes from redirect location strings i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:34:20.745821+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is not present in Tomcat 10.1.33. The vulnerability involved security constraints with empty-string URL patterns (\"\") not being correctly matched against context root requests (\"/\"), allowing unauthorized access to protected resources. The fix was committed to upstream Apache Tomcat in February 2018 by Mark Thomas (commit 723ea6a5bc) and was included in the Tomcat 10.1.33 release ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 is not present in Tomcat 10.1.33. The vulnerability involved security constraints with empty-string URL patterns (\"\") not being correctly matched against context root requests (\"/\"), allowing unauthorized access to protected resources. The fix was committed to upstream Apache Tomcat in February 2018 by Mark Thomas (commit 723ea6a5bc) and was included in the Tomcat 10.1.33 release ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 10.1.33. The vulnerability (servlet security annotations applied at servlet load time rather than application startup, causing servlet-loading-order-dependent authorization bypass) was fixed by upstream Apache Tomcat in February 2018 (commit 3e54b2a631). The fix shipped in the upstream Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable code patt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 10.1.33. The vulnerability (servlet security annotations applied at servlet load time rather than application startup, causing servlet-loading-order-dependent authorization bypass) was fixed by upstream Apache Tomcat in February 2018 (commit 3e54b2a631). The fix shipped in the upstream Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable code patt..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.33 is not affected by CVE-2018-1336. The vulnerability existed in a custom UTF-8 decoder (Utf8Decoder.java) that caused an infinite loop when handling supplementary characters with buffer overflow. This custom decoder was completely removed from Apache Tomcat in upstream commit a9ca10266b (April 26, 2022) and replaced with Java's standard CharsetDecoder, which does not have this vulnerability. The removal was already present in the upstream Tomcat 10.1.33 release before TuxCare onboarding, so the vulnerable code never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Tomcat 10.1.33 is not affected by CVE-2018-1336. The vulnerability existed in a custom UTF-8 decoder (Utf8Decoder.java) that caused an infinite loop when handling supplementary characters with buffer overflow. This custom decoder was completely removed from Apache Tomcat in upstream commit a9ca10266b (April 26, 2022) and replaced with Java's standard CharsetDecoder, which does not have this vulnerability. The removal was already present in the upstream Tomcat 10.1.33 release before TuxCare onboarding, so the vulnerable code never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.33 is not affected by CVE-2018-8014. The insecure CORS filter defaults vulnerability was fixed by upstream commit d83a76732e (author: markt@apache.org) which was already present in the Apache Tomcat 10.1.33 release that TuxCare onboarded. The target code shows secure defaults: DEFAULT_ALLOWED_ORIGINS=\"\" and DEFAULT_SUPPORTS_CREDENTIALS=\"false\", plus validation preventing the insecure combination of any-origin with credentials-enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "Target Tomcat 10.1.33 is not affected by CVE-2018-8014. The insecure CORS filter defaults vulnerability was fixed by upstream commit d83a76732e (author: markt@apache.org) which was already present in the Apache Tomcat 10.1.33 release that TuxCare onboarded. The target code shows secure defaults: DEFAULT_ALLOWED_ORIGINS=\"\" and DEFAULT_SUPPORTS_CREDENTIALS=\"false\", plus validation preventing the insecure combination of any-origin with credentials-enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 (missing hostname verification in WebSocket TLS client) is NOT present in Apache Tomcat 10.1.33. The fix was applied by upstream Apache Tomcat in June 2018 (commit 2835bb4e by markt@apache.org) and was already included in version 10.1.33 when TuxCare onboarded it in October 2026. The hostname verification code (setEndpointIdentificationAlgorithm(\"HTTPS\")) is present and unconditionally enabled at WsWebSocketContainer.java lines 954-960.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 (missing hostname verification in WebSocket TLS client) is NOT present in Apache Tomcat 10.1.33. The fix was applied by upstream Apache Tomcat in June 2018 (commit 2835bb4e by markt@apache.org) and was already included in version 10.1.33 when TuxCare onboarded it in October 2026. The hostname verification code (setEndpointIdentificationAlgorithm(\"HTTPS\")) is present and unconditionally enabled at WsWebSocketContainer.java lines 954-960.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:20:38.807042+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.33 is NOT vulnerable to CVE-2018-8037. The vulnerability involves a race condition in async request handling that could cause response mixing between users. The fix for this CVE was already present in the upstream Apache Tomcat 10.1.33 release before TuxCare onboarded it. The target contains complete protection via: (1) generation tracking to prevent stale async timeout proce...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.33 is NOT vulnerable to CVE-2018-8037. The vulnerability involves a race condition in async request handling that could cause response mixing between users. The fix for this CVE was already present in the upstream Apache Tomcat 10.1.33 release before TuxCare onboarded it. The target contains complete protection via: (1) generation tracking to prevent stale async timeout proce..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 is not present in Apache Tomcat 10.1.33. The vulnerability required two attack vectors: (1) streams with blocking I/O operations that never complete, exhausting server threads, and (2) excessive overhead frames (SETTINGS, PING, PRIORITY) consuming server resources. Both defenses were added by upstream Apache Tomcat in February 2019: stream-level read/write timeouts (default 20 seconds) that release threads when blocking I/O doesn't progress, and overhead frame counting that closes connections when control frames dominate over data frames. These fixes were already present in Apache Tomcat 10.1.33 when TuxCare onboarded it in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 is not present in Apache Tomcat 10.1.33. The vulnerability required two attack vectors: (1) streams with blocking I/O operations that never complete, exhausting server threads, and (2) excessive overhead frames (SETTINGS, PING, PRIORITY) consuming server resources. Both defenses were added by upstream Apache Tomcat in February 2019: stream-level read/write timeouts (default 20 seconds) that release threads when blocking I/O doesn't progress, and overhead frame counting that closes connections when control frames dominate over data frames. These fixes were already present in Apache Tomcat 10.1.33 when TuxCare onboarded it in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects Tomcat 7.0.0-7.0.93, 8.5.0-8.5.39, and 9.0.0.M1-9.0.0.17 due to XSS in the SSI printenv command when it echoes variables without HTML entity encoding. The target (Tomcat 10.1.33) is not affected because the upstream fix by Mark Thomas (commit 15fcd166ea, 2019-03-11) was already present when TuxCare onboarded version 10.1.33 in October 2026. The SSIPrintenv.java file uses S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects Tomcat 7.0.0-7.0.93, 8.5.0-8.5.39, and 9.0.0.M1-9.0.0.17 due to XSS in the SSI printenv command when it echoes variables without HTML entity encoding. The target (Tomcat 10.1.33) is not affected because the upstream fix by Mark Thomas (commit 15fcd166ea, 2019-03-11) was already present when TuxCare onboarded version 10.1.33 in October 2026. The SSIPrintenv.java file uses S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.33 is NOT affected by CVE-2019-0232. The vulnerability (Windows command injection via CGI command line arguments) was fixed in upstream Tomcat commit 4b244d827a (April 2019) by Mark Thomas. This fix\u2014which validates decoded command line arguments against a character whitelist pattern\u2014was already present in the Tomcat 10.1.33 release that TuxCare onboarded (October 2026). The target contains the defense code at CGIServlet.java:757-764, which rejects arguments containing dangerous characters before passing them to the OS. Since the fix was authored by the upstream vendor (markt@apache.org) and shipped in the original release, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "Tomcat 10.1.33 is NOT affected by CVE-2019-0232. The vulnerability (Windows command injection via CGI command line arguments) was fixed in upstream Tomcat commit 4b244d827a (April 2019) by Mark Thomas. This fix\u2014which validates decoded command line arguments against a character whitelist pattern\u2014was already present in the Tomcat 10.1.33 release that TuxCare onboarded (October 2026). The target contains the defense code at CGIServlet.java:757-764, which rejects arguments containing dangerous characters before passing them to the OS. Since the fix was authored by the upstream vendor (markt@apache.org) and shipped in the original release, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 (HTTP/2 connection window exhaustion DoS) is NOT present in Apache Tomcat 10.1.33. The vulnerability was fixed in upstream commit 7f748eb6bfaba5207c89dbd7d5adf50fae847145 (2019-04-30) by Mark Thomas, which was already included in the Tomcat 10.1.33 release that TuxCare onboarded. The fix adds timeout-based wait for connection window allocation, preventing indefinite thread blocking when clients withhold WINDOW_UPDATE messages for stream 0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "CVE-2019-10072 (HTTP/2 connection window exhaustion DoS) is NOT present in Apache Tomcat 10.1.33. The vulnerability was fixed in upstream commit 7f748eb6bfaba5207c89dbd7d5adf50fae847145 (2019-04-30) by Mark Thomas, which was already included in the Tomcat 10.1.33 release that TuxCare onboarded. The fix adds timeout-based wait for connection window allocation, preventing indefinite thread blocking when clients withhold WINDOW_UPDATE messages for stream 0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 does not affect Apache Tomcat 10.1.33. The vulnerable component (JmxRemoteLifecycleListener) was removed by Apache upstream on January 15, 2020 (commit 46fbf32e55), before Tomcat 10.0.0-M1 was released. Tomcat 10.1.33 never had this component, so the vulnerability pattern cannot exist. The CVE affects Tomcat 7.0.x, 8.5.x, and 9.0.x versions that had the JmxRemoteLifecycleListener, but Tomcat 10.x was architected without it from inception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 does not affect Apache Tomcat 10.1.33. The vulnerable component (JmxRemoteLifecycleListener) was removed by Apache upstream on January 15, 2020 (commit 46fbf32e55), before Tomcat 10.0.0-M1 was released. Tomcat 10.1.33 never had this component, so the vulnerability pattern cannot exist. The CVE affects Tomcat 7.0.x, 8.5.x, and 9.0.x versions that had the JmxRemoteLifecycleListener, but Tomcat 10.x was architected without it from inception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.33 is not affected by CVE-2019-17563 (session fixation vulnerability in FORM authentication). The fix was applied by Apache upstream on December 5, 2019 (commit 1ecba14e69) by Mark Thomas, before Tomcat 10.1.33 was released. The vulnerable code pattern (storing Principal in FORM_PRINCIPAL_NOTE session note before full registration) does not exist in this version. The fixed pattern is present: register() is called immediately after authentication, checkForCachedAuthentication() is positioned after request matching, and FORM_PRINCIPAL_NOTE constant has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "Tomcat 10.1.33 is not affected by CVE-2019-17563 (session fixation vulnerability in FORM authentication). The fix was applied by Apache upstream on December 5, 2019 (commit 1ecba14e69) by Mark Thomas, before Tomcat 10.1.33 was released. The vulnerable code pattern (storing Principal in FORM_PRINCIPAL_NOTE session note before full registration) does not exist in this version. The fixed pattern is present: register() is called immediately after authentication, checkForCachedAuthentication() is positioned after request matching, and FORM_PRINCIPAL_NOTE constant has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:25:43.115991+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 is NOT present in Apache Tomcat 10.1.33. This CVE describes a regression in Transfer-Encoding header parsing that affected specific versions (9.0.28-9.0.30, 8.5.48-8.5.50, 7.0.98-7.0.99) where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The upstream fix (commit 3c295d913e) was already included in Apache Tomcat 10.1.33 before TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 is NOT present in Apache Tomcat 10.1.33. This CVE describes a regression in Transfer-Encoding header parsing that affected specific versions (9.0.28-9.0.30, 8.5.48-8.5.50, 7.0.98-7.0.99) where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The upstream fix (commit 3c295d913e) was already included in Apache Tomcat 10.1.33 before TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-11996 is not present in Apache Tomcat 10.1.33-tuxcare.2. The vulnerability required a numeric loop that iterates through all potential stream IDs between maxActiveRemoteStreamId and a new large stream ID, causing CPU exhaustion when an attacker sends HTTP/2 requests with very large stream IDs (e.g., Integer.MAX_VALUE - 8). The vulnerable code pattern (for loop: `for (int i = maxActiveRemoteStreamId + 2; i < newMaxActiveRemoteStreamId; i += 2)`) does not exist in the target. The upstream Apache Tomcat 10.1.33 release already contained the fix (authored by markt@apache.org in May 2020, later refactored in Sept 2020) before TuxCare onboarded it in the first TuxCare commit 47a79a9e4c. The target uses `pruneClosedStreams()` which iterates only over actual streams in the collection (`for (AbstractNonZeroStream stream : streams.values())`), making stream ID magnitude irrelevant and preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 is not present in Apache Tomcat 10.1.33-tuxcare.2. The vulnerability required a numeric loop that iterates through all potential stream IDs between maxActiveRemoteStreamId and a new large stream ID, causing CPU exhaustion when an attacker sends HTTP/2 requests with very large stream IDs (e.g., Integer.MAX_VALUE - 8). The vulnerable code pattern (for loop: `for (int i = maxActiveRemoteStreamId + 2; i < newMaxActiveRemoteStreamId; i += 2)`) does not exist in the target. The upstream Apache Tomcat 10.1.33 release already contained the fix (authored by markt@apache.org in May 2020, later refactored in Sept 2020) before TuxCare onboarded it in the first TuxCare commit 47a79a9e4c. The target uses `pruneClosedStreams()` which iterates only over actual streams in the collection (`for (AbstractNonZeroStream stream : streams.values())`), making stream ID magnitude irrelevant and preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 affects Apache Tomcat's HTTP header parsing, allowing invalid headers with improper line terminators (bare CR without LF) or control characters to be accepted, enabling HTTP Request Smuggling. The target (Tomcat 10.1.33) contains the upstream fix from commit ae8c82eff96 \"Stricter header value parsing\" by Mark Thomas, which was already present in the Apache Tomcat 10.1.33 release t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 affects Apache Tomcat's HTTP header parsing, allowing invalid headers with improper line terminators (bare CR without LF) or control characters to be accepted, enabling HTTP Request Smuggling. The target (Tomcat 10.1.33) contains the upstream fix from commit ae8c82eff96 \"Stricter header value parsing\" by Mark Thomas, which was already present in the Apache Tomcat 10.1.33 release t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) allows attackers to read arbitrary files and execute JSP code via malicious AJP request attributes. The target is Apache Tomcat 10.1.33. Analysis confirms all four defensive layers from the upstream patches are present: (1) AJP connector disabled by default (conf/server.xml:105-112), (2) default loopback binding (AbstractAjpProtocol.java:52), (3) secret authentication with secretRequired=true (AbstractAjpProtocol.java:142-188,273-281; AjpProcessor.java:728-729,842-865), and (4) arbitrary attribute blocking (AbstractAjpProtocol.java:191-203; AjpProcessor.java:767-775). The fix was authored by Mark Thomas (Apache upstream) in commit aba0c9a488 dated January 21, 2020, and was already present in the upstream 10.1.33 release when TuxCare onboarded it (commit 47a79a9e4c, October 2026). No TuxCare modifications to the AJP files exist for this version. Verdict: not_affected because the vulnerable code pattern was removed by an upstream fix that shipped in version 10.1.33.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) allows attackers to read arbitrary files and execute JSP code via malicious AJP request attributes. The target is Apache Tomcat 10.1.33. Analysis confirms all four defensive layers from the upstream patches are present: (1) AJP connector disabled by default (conf/server.xml:105-112), (2) default loopback binding (AbstractAjpProtocol.java:52), (3) secret authentication with secretRequired=true (AbstractAjpProtocol.java:142-188,273-281; AjpProcessor.java:728-729,842-865), and (4) arbitrary attribute blocking (AbstractAjpProtocol.java:191-203; AjpProcessor.java:767-775). The fix was authored by Mark Thomas (Apache upstream) in commit aba0c9a488 dated January 21, 2020, and was already present in the upstream 10.1.33 release when TuxCare onboarded it (commit 47a79a9e4c, October 2026). No TuxCare modifications to the AJP files exist for this version. Verdict: not_affected because the vulnerable code pattern was removed by an upstream fix that shipped in version 10.1.33.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-9484 is NOT present in Apache Tomcat 10.1.33. The vulnerability (path traversal in FileStore allowing arbitrary file deserialization) was fixed by upstream Apache in commits bb33048e3f9b (May 5, 2020) and 70da1aaa51e (January 12, 2022), both authored by Mark Thomas. Both commits were already present in the Apache Tomcat 10.1.33 release when TuxCare onboarded it on October 7, 2026. The fix validates that file paths constructed from session IDs remain within the designated storage directory (FileStore.java lines 303-306), preventing path traversal attacks that could lead to deserialization of attacker-controlled files and remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 is NOT present in Apache Tomcat 10.1.33. The vulnerability (path traversal in FileStore allowing arbitrary file deserialization) was fixed by upstream Apache in commits bb33048e3f9b (May 5, 2020) and 70da1aaa51e (January 12, 2022), both authored by Mark Thomas. Both commits were already present in the Apache Tomcat 10.1.33 release when TuxCare onboarded it on October 7, 2026. The fix validates that file paths constructed from session IDs remain within the designated storage directory (FileStore.java lines 303-306), preventing path traversal attacks that could lead to deserialization of attacker-controlled files and remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 is NOT present in Apache Tomcat 10.1.33. The vulnerability, which allowed JSP source code disclosure when serving resources from network locations on Windows NTFS due to unexpected behavior of File.getCanonicalPath() with colon characters, was fixed in upstream Apache Tomcat commit 7f004ac4531c45f9a2a2d1470561fe135cf27bc2 (BZ 64871) by Mark Thomas on 2020-11-06. This fix was alre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 is NOT present in Apache Tomcat 10.1.33. The vulnerability, which allowed JSP source code disclosure when serving resources from network locations on Windows NTFS due to unexpected behavior of File.getCanonicalPath() with colon characters, was fixed in upstream Apache Tomcat commit 7f004ac4531c45f9a2a2d1470561fe135cf27bc2 (BZ 64871) by Mark Thomas on 2020-11-06. This fix was alre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 is NOT present in this Tomcat 10.1.33 target. The vulnerability involved incorrect timing of leftover input restoration during h2c connection upgrades, potentially causing request data from user A to leak to user B. The upstream fix (commit dd757c0a893 by Mark Thomas, 2021-01-14) was already included in Apache Tomcat 10.1.33 when TuxCare onboarded it. The current code correctly calls wrapper.unRead(leftOverInput) BEFORE creating the upgrade processor (line 913), preventing cross-request data leakage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 is NOT present in this Tomcat 10.1.33 target. The vulnerability involved incorrect timing of leftover input restoration during h2c connection upgrades, potentially causing request data from user A to leak to user B. The upstream fix (commit dd757c0a893 by Mark Thomas, 2021-01-14) was already included in Apache Tomcat 10.1.33 when TuxCare onboarded it. The current code correctly calls wrapper.unRead(leftOverInput) BEFORE creating the upgrade processor (line 913), preventing cross-request data leakage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.33 is not affected by CVE-2021-25329. The vulnerability involved inadequate subdirectory path validation using string-based canonical path prefix matching, which could be bypassed to access files outside intended directories. The fix (using java.nio.file.Path for consistent subdirectory checking) was already present in the upstream Apache Tomcat 10.1.33 release before TuxCare onboarding. All five affected files (FileStore.java, DefaultServlet.java, ExpandWar.java, HostConfig.java, ContextConfig.java) contain the Path-based validation. No instances of the vulnerable string-based pattern remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "Target Tomcat 10.1.33 is not affected by CVE-2021-25329. The vulnerability involved inadequate subdirectory path validation using string-based canonical path prefix matching, which could be bypassed to access files outside intended directories. The fix (using java.nio.file.Path for consistent subdirectory checking) was already present in the upstream Apache Tomcat 10.1.33 release before TuxCare onboarding. All five affected files (FileStore.java, DefaultServlet.java, ExpandWar.java, HostConfig.java, ContextConfig.java) contain the Path-based validation. No instances of the vulnerable string-based pattern remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 is not present in Apache Tomcat 10.1.33. The upstream fix for rejecting malformed Content-Length headers was already included in the Apache Tomcat 10.1.33 release that TuxCare onboarded. The defense code at Http11InputBuffer.java:1046-1049 forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader configuration, preventing the request smuggling vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "CVE-2022-42252 is not present in Apache Tomcat 10.1.33. The upstream fix for rejecting malformed Content-Length headers was already included in the Apache Tomcat 10.1.33 release that TuxCare onboarded. The defense code at Http11InputBuffer.java:1046-1049 forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader configuration, preventing the request smuggling vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-45143 affects JsonErrorReportValve in Apache Tomcat when type, message, or description values are not escaped before being concatenated into JSON output, allowing JSON injection. The target repository (Apache Tomcat 10.1.33) is NOT AFFECTED because the fix was already present in the upstream 10.1.33 release. The JSONFilter.escape() method and its usage in JsonErrorReportValve were introduced by upstream Apache committer Mark Thomas (markt@apache.org) in commit 1f50bff8daabb48c5f15398689988f26aac6ec56, which was included in Apache Tomcat releases from 10.1.10 onwards. TuxCare onboarded version 10.1.33 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 affects JsonErrorReportValve in Apache Tomcat when type, message, or description values are not escaped before being concatenated into JSON output, allowing JSON injection. The target repository (Apache Tomcat 10.1.33) is NOT AFFECTED because the fix was already present in the upstream 10.1.33 release. The JSONFilter.escape() method and its usage in JsonErrorReportValve were introduced by upstream Apache committer Mark Thomas (markt@apache.org) in commit 1f50bff8daabb48c5f15398689988f26aac6ec56, which was included in Apache Tomcat releases from 10.1.10 onwards. TuxCare onboarded version 10.1.33 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 (Apache Commons FileUpload DoS via unbounded request parts) is NOT a vulnerability in this target. The fix was already present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The fileCountMax limit enforcement is fully implemented in FileUploadBase.java (lines 118, 206-217, 315-318) and properly configured in Request.java (line 2599). The fixing commit (8a2285f13af) was authored by upstream Apache developer markt@apache.org on 2023-01-03 and shipped in the 10.1.33 release before TuxCare's onboarding commit (47a79a9e4c). The vulnerable pattern (unbounded accumulation of multipart request parts) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 (Apache Commons FileUpload DoS via unbounded request parts) is NOT a vulnerability in this target. The fix was already present in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The fileCountMax limit enforcement is fully implemented in FileUploadBase.java (lines 118, 206-217, 315-318) and properly configured in Request.java (line 2599). The fixing commit (8a2285f13af) was authored by upstream Apache developer markt@apache.org on 2023-01-03 and shipped in the 10.1.33 release before TuxCare's onboarding commit (47a79a9e4c). The vulnerable pattern (unbounded accumulation of multipart request parts) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 is NOT present in Apache Tomcat 10.1.33. The vulnerability was an off-by-one error in Parameters.addParameter() that allowed bypassing maxParameterCount when exactly that many query parameters were supplied. The fix (using `>=` instead of `>` and checking before incrementing) was included in the upstream Apache Tomcat 10.1.33 release by Mark Thomas (markt@apache.org) on 2023-04-11, well before the 10.1.33 release tag. The target repository's HEAD contains the fixed code at java/org/apache/tomcat/util/http/Parameters.java:204-210.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "CVE-2023-28709 is NOT present in Apache Tomcat 10.1.33. The vulnerability was an off-by-one error in Parameters.addParameter() that allowed bypassing maxParameterCount when exactly that many query parameters were supplied. The fix (using `>=` instead of `>` and checking before incrementing) was included in the upstream Apache Tomcat 10.1.33 release by Mark Thomas (markt@apache.org) on 2023-04-11, well before the 10.1.33 release tag. The target repository's HEAD contains the fixed code at java/org/apache/tomcat/util/http/Parameters.java:204-210.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-34981 describes a regression in Apache Tomcat's AJP connector where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from the previous request (information leak). The target version 10.1.33 is NOT affected because the upstream fix (bug 66591) was already included in the 10.1.33 release. The code at AjpProcessor.java:962-1004 uses the fixed pattern (boolean needAjpMessageHeader with while loop) ensuring SEND_HEADERS is always sent even when numHeaders == 0. The vulnerable pattern (SEND_HEADERS only sent when i==0 inside the for loop) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "CVE-2023-34981 describes a regression in Apache Tomcat's AJP connector where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from the previous request (information leak). The target version 10.1.33 is NOT affected because the upstream fix (bug 66591) was already included in the 10.1.33 release. The code at AjpProcessor.java:962-1004 uses the fixed pattern (boolean needAjpMessageHeader with while loop) ensuring SEND_HEADERS is always sent even when numHeaders == 0. The vulnerable pattern (SEND_HEADERS only sent when i==0 inside the for loop) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T00:52:46.305817+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) is not present in Tomcat 10.1.33. The fix preventing protocol-relative redirects was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable pattern never existed in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) is not present in Tomcat 10.1.33. The fix preventing protocol-relative redirects was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable pattern never existed in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:25:14.318468+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is not present in Tomcat 10.1.33. The fix was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. Apache commit 76bb4bfbfea (2023-10-05) by Mark Thomas introduced comprehensive HTTP/2 overhead protection including: (1) overheadResetFactor=50 for weighted tracking of RST_STREAM frames, (2) overhead tracking in reset() method, (3) overhead tracking for priorityUpdate() frames, and (4) isOverheadLimitExceeded() check in Http2AsyncParser to stop parsing when limits exceeded. All defense components are present and active by default in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is not present in Tomcat 10.1.33. The fix was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. Apache commit 76bb4bfbfea (2023-10-05) by Mark Thomas introduced comprehensive HTTP/2 overhead protection including: (1) overheadResetFactor=50 for weighted tracking of RST_STREAM frames, (2) overhead tracking in reset() method, (3) overhead tracking for priorityUpdate() frames, and (4) isOverheadLimitExceeded() check in Http2AsyncParser to stop parsing when limits exceeded. All defense components are present and active by default in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:11:13.689447+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.33. The vulnerability required improper parsing of HTTP trailer headers that could lead to request smuggling. The upstream Apache Tomcat project fixed this in October 2023 and subsequently refactored the code in April 2024 to use a centralized HttpHeaderParser class. Version 10.1.33, released November 2024, shipped with the fix already present. The r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.33. The vulnerability required improper parsing of HTTP trailer headers that could lead to request smuggling. The upstream Apache Tomcat project fixed this in October 2023 and subsequently refactored the code in April 2024 to use a centralized HttpHeaderParser class. Version 10.1.33, released November 2024, shipped with the fix already present. The r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.33 is not affected by CVE-2023-46589. The upstream Apache Tomcat 10.1.33 release already included a refactoring that consolidated HTTP header and trailer parsing into a common HttpHeaderParser class (commits a5a7c11250 and 92e3c7a7ad by Mark Thomas, April 2024). This parser includes the exact character validation logic that CVE-2023-46589 patches added to earlier Tomcat versions: header names must be valid HTTP tokens, and header values must not contain control characters except tab. The vulnerable pattern (missing trailer header validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "Target version 10.1.33 is not affected by CVE-2023-46589. The upstream Apache Tomcat 10.1.33 release already included a refactoring that consolidated HTTP header and trailer parsing into a common HttpHeaderParser class (commits a5a7c11250 and 92e3c7a7ad by Mark Thomas, April 2024). This parser includes the exact character validation logic that CVE-2023-46589 patches added to earlier Tomcat versions: header names must be valid HTTP tokens, and header values must not contain control characters except tab. The vulnerable pattern (missing trailer header validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:44:54.169641+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 10.1.33 is not affected by CVE-2024-21733. The vulnerability, which affects Tomcat 8.5.7-8.5.63 and 9.0.0-M11 through 9.0.43, concerns information disclosure through error messages when I/O operations are attempted on closed/invalid connections. The upstream fixes (commits ce4f9a5e0e and 86ccc43940 by Mark Thomas, Feb 2021) were already included in Tomcat 10.1.33 before TuxCare onboarded...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 Tomcat 10.1.33 is not affected by CVE-2024-21733. The vulnerability, which affects Tomcat 8.5.7-8.5.63 and 9.0.0-M11 through 9.0.43, concerns information disclosure through error messages when I/O operations are attempted on closed/invalid connections. The upstream fixes (commits ce4f9a5e0e and 86ccc43940 by Mark Thomas, Feb 2021) were already included in Tomcat 10.1.33 before TuxCare onboarded..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.33 is not affected. The upstream Apache Tomcat fix for CVE-2024-24549 is already present in this version. The fix moves HTTP/2 header validation from after all frames are processed to after each individual HEADERS/CONTINUATION frame, preventing attackers from forcing the server to buffer excessive header data before limits are checked. The fix was authored by upstream (Mark Thomas, markt@apache.org) on Jan 25, 2024 and was included in Apache Tomcat 10.1.19+. TuxCare onboarded upstream 10.1.33 which already contained this fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "Target version 10.1.33 is not affected. The upstream Apache Tomcat fix for CVE-2024-24549 is already present in this version. The fix moves HTTP/2 header validation from after all frames are processed to after each individual HEADERS/CONTINUATION frame, preventing attackers from forcing the server to buffer excessive header data before limits are checked. The fix was authored by upstream (Mark Thomas, markt@apache.org) on Jan 25, 2024 and was included in Apache Tomcat 10.1.19+. TuxCare onboarded upstream 10.1.33 which already contained this fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-34750 is NOT present in the target. The vulnerability involves incorrect HTTP/2 stream counting leading to connections remaining open indefinitely. The upstream fix (commit 2afae300c9 by Mark Thomas) was already included in Apache Tomcat 10.1.25, and is present in the target's base version 10.1.33. The fix adds atomic compare-and-set logic to ensure each stream is counted exactly once and removed from the active count exactly once, preventing the miscounting that leads to incorrect timeout application. TuxCare onboarded upstream 10.1.33 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "impact_statement": "CVE-2024-34750 is NOT present in the target. The vulnerability involves incorrect HTTP/2 stream counting leading to connections remaining open indefinitely. The upstream fix (commit 2afae300c9 by Mark Thomas) was already included in Apache Tomcat 10.1.25, and is present in the target's base version 10.1.33. The fix adds atomic compare-and-set logic to ensure each stream is counted exactly once and removed from the active count exactly once, preventing the miscounting that leads to incorrect timeout application. TuxCare onboarded upstream 10.1.33 which already contained this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.33 is NOT AFFECTED by CVE-2024-38286. The vulnerability allows attackers to cause OutOfMemoryError by abusing TLS handshake re-keying to accumulate unbounded handshake wrap requests. However, version 10.1.33 already contains the upstream Apache fix (commit 3344c17cef by Mark Thomas, first released in 10.1.25 on 2024-06-14). The fix adds: (1) In SecureNio2Channel: handshakeWrapQueueLength counter with HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT=100; (2) In SecureNioChannel: needHandshakeWrap boolean flag. Both prevent unbounded accumulation by terminating connections when limits are exceeded. The fix was shipped in the upstream 10.1.33 release and onboarded by TuxCare on 2026-10-07. CVE affected versions 10.1.0-M1 through 10.1.24; fixed in 10.1.25+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "impact_statement": "Apache Tomcat 10.1.33 is NOT AFFECTED by CVE-2024-38286. The vulnerability allows attackers to cause OutOfMemoryError by abusing TLS handshake re-keying to accumulate unbounded handshake wrap requests. However, version 10.1.33 already contains the upstream Apache fix (commit 3344c17cef by Mark Thomas, first released in 10.1.25 on 2024-06-14). The fix adds: (1) In SecureNio2Channel: handshakeWrapQueueLength counter with HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT=100; (2) In SecureNioChannel: needHandshakeWrap boolean flag. Both prevent unbounded accumulation by terminating connections when limits are exceeded. The fix was shipped in the upstream 10.1.33 release and onboarded by TuxCare on 2026-10-07. CVE affected versions 10.1.0-M1 through 10.1.24; fixed in 10.1.25+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:31:30.745035+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-52317 affects Apache Tomcat versions 10.1.27-10.1.30, with the fix released in version 10.1.31. The target repository is version 10.1.33, which already contains the upstream vendor's fix. The double-checked locking mechanism to prevent duplicate request/response recycling is present in both Stream.java (lines 111-112, 837-855) and StreamProcessor.java (line 149). This fix was shipped i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-52317 affects Apache Tomcat versions 10.1.27-10.1.30, with the fix released in version 10.1.31. The target repository is version 10.1.33, which already contains the upstream vendor's fix. The double-checked locking mechanism to prevent duplicate request/response recycling is present in both Stream.java (lines 111-112, 837-855) and StreamProcessor.java (line 149). This fix was shipped i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "action_statement": "Vulnerability CVE-2025-31650 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "action_statement": "Vulnerability CVE-2025-48988 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.33 is not affected by CVE-2025-52434 because the vulnerable APR/Native connector (AprEndpoint.java) was removed from the Tomcat 10.1.x line by Apache upstream before the 10.1.0 release. The removal occurred in commit 314568fa450680711f12f01ee050f2166f4263bd (August 2021, author: Mark Thomas <markt@apache.org>), which is an ancestor of the onboarding commit for version 10.1.33. The CVE explicitly affects \"the APR/Native connector\" which is completely absent from this target version. Only NioEndpoint and Nio2Endpoint implementations exist, which use pure Java NIO APIs rather than native JNI socket calls, and therefore do not exhibit the same race condition vulnerability pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "impact_statement": "Tomcat 10.1.33 is not affected by CVE-2025-52434 because the vulnerable APR/Native connector (AprEndpoint.java) was removed from the Tomcat 10.1.x line by Apache upstream before the 10.1.0 release. The removal occurred in commit 314568fa450680711f12f01ee050f2166f4263bd (August 2021, author: Mark Thomas <markt@apache.org>), which is an ancestor of the onboarding commit for version 10.1.33. The CVE explicitly affects \"the APR/Native connector\" which is completely absent from this target version. Only NioEndpoint and Nio2Endpoint implementations exist, which use pure Java NIO APIs rather than native JNI socket calls, and therefore do not exhibit the same race condition vulnerability pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.33 is NOT affected by CVE-2026-29129. The vulnerability was introduced in a later version (between 10.1.33 and 10.1.51) when TLS 1.3 cipher suite support was added in January 2026. The target version uses a simpler code path that already preserves cipher order via LinkedHashSet, and lacks the HashSet-based cipher merging logic that caused the order preservation bug in version...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.33 is NOT affected by CVE-2026-29129. The vulnerability was introduced in a later version (between 10.1.33 and 10.1.51) when TLS 1.3 cipher suite support was added in January 2026. The target version uses a simpler code path that already preserves cipher order via LinkedHashSet, and lacks the HashSet-based cipher merging logic that caused the order preservation bug in version..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.33 is NOT AFFECTED by CVE-2026-32990. The vulnerable code pattern (the checkSni method with improper protocol hostname normalization) does not exist in this version. The vulnerability was introduced in later versions (10.1.50-10.1.52) when the strict SNI validation feature was added via CVE-2025-66614's fix, and the incomplete normalization in that new code created CVE-2026-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.33 is NOT AFFECTED by CVE-2026-32990. The vulnerable code pattern (the checkSni method with improper protocol hostname normalization) does not exist in this version. The vulnerability was introduced in later versions (10.1.50-10.1.52) when the strict SNI validation feature was added via CVE-2025-66614's fix, and the incomplete normalization in that new code created CVE-2026-..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:37:00.058426+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.33-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:25.656977+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 10.1.33-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}