{
  "@id": "urn:uuid:098c7231-78ef-4cec-b66f-773e69549fe7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 68,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T13:33:00.186713+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:16:13.062310+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16 where the name parameter in the host-manager/html/add endpoint was rendered without HTML escaping. The target (Tomcat 10.1.50) is not affected because the upstream Apache Tomcat project fixed this vulnerability years ago. The fix\u2014HTML escaping via Escape.htmlElementContent()\u2014was introduced in commit 17fd...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16 where the name parameter in the host-manager/html/add endpoint was rendered without HTML escaping. The target (Tomcat 10.1.50) is not affected because the upstream Apache Tomcat project fixed this vulnerability years ago. The fix\u2014HTML escaping via Escape.htmlElementContent()\u2014was introduced in commit 17fd..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:09:26.959129+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 is NOT present in Apache Tomcat 10.1.50. The vulnerability caused AJP processors to hang when receiving Content-Length: 0 requests. The target contains an explicit defense at AjpProcessor.java:613-616 that checks for contentLength == 0 and skips body reading (sets endOfStream=true, returns false), preventing the hang. This fix was authored by upstream Apache Tomcat developer Mark ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 is NOT present in Apache Tomcat 10.1.50. The vulnerability caused AJP processors to hang when receiving Content-Length: 0 requests. The target contains an explicit defense at AjpProcessor.java:613-616 that checks for contentLength == 0 and skips body reading (sets endOfStream=true, returns false), preventing the hang. This fix was authored by upstream Apache Tomcat developer Mark ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affected Apache Tomcat 7.0.0 to 7.0.79 on Windows, allowing JSP file upload via specially crafted filenames (trailing spaces/dots that Windows strips). The target (Tomcat 10.1.50) is NOT AFFECTED because it uses a completely different architecture (WebResourceRoot/AbstractFileResourceSet instead of FileDirContext) that includes comprehensive Windows filename validation. The defense was added by Apache upstream (Mark Thomas, commit a9dd96046d7, September 2017) and shipped in the upstream 10.1.50 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affected Apache Tomcat 7.0.0 to 7.0.79 on Windows, allowing JSP file upload via specially crafted filenames (trailing spaces/dots that Windows strips). The target (Tomcat 10.1.50) is NOT AFFECTED because it uses a completely different architecture (WebResourceRoot/AbstractFileResourceSet instead of FileDirContext) that includes comprehensive Windows filename validation. The defense was added by Apache upstream (Mark Thomas, commit a9dd96046d7, September 2017) and shipped in the upstream 10.1.50 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is not present in the target. The vulnerability allowed uploading JSP files via HTTP PUT requests with trailing-slash paths (e.g., \"shell.jsp/\") that would normalize to executable paths without the slash. Apache Tomcat fixed this in commits b7e0435d17 and b577f9a799 (authored by Mark Thomas, markt@apache.org) by adding two defenses: (1) rejecting file writes when path ends with \"/\" in DirResourceSet.write():270-272, and (2) rejecting file reads when path ends with \"/\" but resolves to a file in AbstractFileResourceSet.file():83-85. Both fixes are present in the target Tomcat 10.1.50 and were included in the upstream release that TuxCare onboarded (first TuxCare commit: 8f04542b9a by amoniatovskiy@cloudlinux.com). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is not present in the target. The vulnerability allowed uploading JSP files via HTTP PUT requests with trailing-slash paths (e.g., \"shell.jsp/\") that would normalize to executable paths without the slash. Apache Tomcat fixed this in commits b7e0435d17 and b577f9a799 (authored by Mark Thomas, markt@apache.org) by adding two defenses: (1) rejecting file writes when path ends with \"/\" in DirResourceSet.write():270-272, and (2) rejecting file reads when path ends with \"/\" but resolves to a file in AbstractFileResourceSet.file():83-85. Both fixes are present in the target Tomcat 10.1.50 and were included in the upstream release that TuxCare onboarded (first TuxCare commit: 8f04542b9a by amoniatovskiy@cloudlinux.com). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is not present in Tomcat 10.1.50. The vulnerability affected Tomcat 7.x/8.x/9.x where application listeners received internal request/response objects instead of facades, allowing untrusted applications to access cross-application data under SecurityManager. The upstream fix (commit dfa4086342, March 2017) modified three files to use request.getRequest() when firing application listeners. This fix was already included in upstream Tomcat 10.1.50 when TuxCare onboarded the version (commit 8f04542b9a). All affected code locations (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use facade objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is not present in Tomcat 10.1.50. The vulnerability affected Tomcat 7.x/8.x/9.x where application listeners received internal request/response objects instead of facades, allowing untrusted applications to access cross-application data under SecurityManager. The upstream fix (commit dfa4086342, March 2017) modified three files to use request.getRequest() when firing application listeners. This fix was already included in upstream Tomcat 10.1.50 when TuxCare onboarded the version (commit 8f04542b9a). All affected code locations (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use facade objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.50 is not affected by CVE-2017-5651. The vulnerability was a sendfile processing race condition that could cause a Processor to be added to the cache twice, leading to request/response mix-up. The fix (commit 9233d9d6a0 by Mark Thomas) was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The fix introduces SendfileState tracking to capture the sendfile processing state before cleanup, preventing the race condition. All fix elements are verified present in the target code: SendfileState local variable (line 265), while loop condition (line 268), processSendfile() method (line 1420), and corrected return logic (line 476).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "The target Apache Tomcat 10.1.50 is not affected by CVE-2017-5651. The vulnerability was a sendfile processing race condition that could cause a Processor to be added to the cache twice, leading to request/response mix-up. The fix (commit 9233d9d6a0 by Mark Thomas) was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The fix introduces SendfileState tracking to capture the sendfile processing state before cleanup, preventing the race condition. All fix elements are verified present in the target code: SendfileState local variable (line 265), while loop condition (line 268), processSendfile() method (line 1420), and corrected return logic (line 476).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Tomcat 10.1.50 repository is NOT AFFECTED by CVE-2018-11784. The vulnerability concerns an open redirect issue in the DefaultServlet's directory redirect logic, where specially crafted URLs with multiple leading slashes could generate protocol-relative redirects (e.g., //evil.com) to attacker-controlled domains. The upstream fix, which strips leading characters when multiple consecut...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 The target Tomcat 10.1.50 repository is NOT AFFECTED by CVE-2018-11784. The vulnerability concerns an open redirect issue in the DefaultServlet's directory redirect logic, where specially crafted URLs with multiple leading slashes could generate protocol-relative redirects (e.g., //evil.com) to attacker-controlled domains. The upstream fix, which strips leading characters when multiple consecut..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:37:49.415596+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 affects Tomcat versions 7.0.0-7.0.84, 8.0.0.RC1-8.0.49, 8.5.0-8.5.27, and 9.0.0.M1-9.0.4. The target version 10.1.50 is not affected because it already contains the upstream fix (commit 723ea6a5bc by Mark Thomas, Feb 2018) that was shipped in the upstream release before TuxCare onboarded version 10.1.50. The fix properly handles security constraints with empty-string URL patterns ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 affects Tomcat versions 7.0.0-7.0.84, 8.0.0.RC1-8.0.49, 8.5.0-8.5.27, and 9.0.0.M1-9.0.4. The target version 10.1.50 is not affected because it already contains the upstream fix (commit 723ea6a5bc by Mark Thomas, Feb 2018) that was shipped in the upstream release before TuxCare onboarded version 10.1.50. The fix properly handles security constraints with empty-string URL patterns ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2018-1305. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied lazily (at servlet load time), which could allow unauthorized access depending on servlet load order. The fix, applied upstream by Apache in February 2018 (commit 3e54b2a6), moved annotation processing to application startup...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 Target version Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2018-1305. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied lazily (at servlet load time), which could allow unauthorized access depending on servlet load order. The fix, applied upstream by Apache in February 2018 (commit 3e54b2a6), moved annotation processing to application startup..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 affected Tomcat's custom Utf8Decoder.java class, which had an infinite loop bug when processing 4-byte UTF-8 supplementary characters with buffer overflow. The upstream fix (commit 92cd494555, April 2018) corrected the overflow handling by rewinding the input position. This fix was already included in Apache Tomcat 10.1.50 when TuxCare onboarded it (Sept 2026). Additionally, the entire custom decoder was removed (commit a9ca10266b, April 2022) because Java 11+ fixed the underlying issues that necessitated the custom implementation. Tomcat 10.1.50 uses java.nio.charset.CharsetDecoder, which does not have this vulnerability. The vulnerable code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 affected Tomcat's custom Utf8Decoder.java class, which had an infinite loop bug when processing 4-byte UTF-8 supplementary characters with buffer overflow. The upstream fix (commit 92cd494555, April 2018) corrected the overflow handling by rewinding the input position. This fix was already included in Apache Tomcat 10.1.50 when TuxCare onboarded it (Sept 2026). Additionally, the entire custom decoder was removed (commit a9ca10266b, April 2022) because Java 11+ fixed the underlying issues that necessitated the custom implementation. Tomcat 10.1.50 uses java.nio.charset.CharsetDecoder, which does not have this vulnerability. The vulnerable code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 affects the CORS filter's default configuration in older Tomcat versions (7.0.41-7.0.88, 8.0.0.RC1-8.0.52, 8.5.0-8.5.31, 9.0.0.M1-9.0.8). The target Tomcat 10.1.50 contains the complete upstream fix authored by Mark Thomas (markt@apache.org) in commit d83a76732e, which was already present in the upstream 10.1.50 release before TuxCare onboarded it (first TuxCare commit 8f04542b9a). The fix includes: (1) secure defaults (DEFAULT_ALLOWED_ORIGINS=\"\", DEFAULT_SUPPORTS_CREDENTIALS=\"false\"), (2) validation preventing supportsCredentials=true with allowedOrigins=*, and (3) updated CORS header logic. The vulnerable pattern (permissive defaults enabling credential disclosure to arbitrary origins) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 affects the CORS filter's default configuration in older Tomcat versions (7.0.41-7.0.88, 8.0.0.RC1-8.0.52, 8.5.0-8.5.31, 9.0.0.M1-9.0.8). The target Tomcat 10.1.50 contains the complete upstream fix authored by Mark Thomas (markt@apache.org) in commit d83a76732e, which was already present in the upstream 10.1.50 release before TuxCare onboarded it (first TuxCare commit 8f04542b9a). The fix includes: (1) secure defaults (DEFAULT_ALLOWED_ORIGINS=\"\", DEFAULT_SUPPORTS_CREDENTIALS=\"false\"), (2) validation preventing supportsCredentials=true with allowedOrigins=*, and (3) updated CORS header logic. The vulnerable pattern (permissive defaults enabling credential disclosure to arbitrary origins) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.50 is NOT affected by CVE-2018-8034. The fix for missing hostname verification in WebSocket TLS client connections was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The vulnerable pattern (missing endpoint identification algorithm) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "Target Tomcat 10.1.50 is NOT affected by CVE-2018-8034. The fix for missing hostname verification in WebSocket TLS client connections was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The vulnerable pattern (missing endpoint identification algorithm) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:24:43.245442+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 is NOT present in Apache Tomcat 10.1.50. Both components of the upstream fix are present: (1) generation tracking that prevents stale async timeout events from being processed after a request completes, and (2) proper connection closure tracking. The fixes were authored by Apache maintainers (Mark Thomas, Remy Maucherat) and shipped in the upstream Tomcat 10.1.50 release before Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 is NOT present in Apache Tomcat 10.1.50. Both components of the upstream fix are present: (1) generation tracking that prevents stale async timeout events from being processed after a request completes, and (2) proper connection closure tracking. The fixes were authored by Apache maintainers (Mark Thomas, Remy Maucherat) and shipped in the upstream Tomcat 10.1.50 release before Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. The target is Apache Tomcat 10.1.50, which already includes all upstream fixes for this vulnerability. The fixes were authored by Mark Thomas (markt@apache.org) in early 2019 and shipped with the upstream Tomcat 10.1.50 release that TuxCare onboarded. The three key defenses are present: (1) stream read timeout preventing indefinite blocking on request body reads, (2) stream write timeout preventing indefinite blocking when flow control window is exhausted, and (3) overhead frame tracking that closes connections sending excessive SETTINGS/PRIORITY/PING frames. All fixes were present before the first TuxCare commit (8f04542b9a \"Onboard version 10.1.50\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. The target is Apache Tomcat 10.1.50, which already includes all upstream fixes for this vulnerability. The fixes were authored by Mark Thomas (markt@apache.org) in early 2019 and shipped with the upstream Tomcat 10.1.50 release that TuxCare onboarded. The three key defenses are present: (1) stream read timeout preventing indefinite blocking on request body reads, (2) stream write timeout preventing indefinite blocking when flow control window is exhausted, and (3) overhead frame tracking that closes connections sending excessive SETTINGS/PRIORITY/PING frames. All fixes were present before the first TuxCare commit (8f04542b9a \"Onboard version 10.1.50\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 10.1.50. The vulnerability concerned the SSI printenv command echoing environment variable values without HTML escaping, enabling XSS attacks. The upstream fix (commit 15fcd166ea by Mark Thomas, 2019-04-09) was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The current code at SSIPrintenv.java:38 properly applies HTML entit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 10.1.50. The vulnerability concerned the SSI printenv command echoing environment variable values without HTML escaping, enabling XSS attacks. The upstream fix (commit 15fcd166ea by Mark Thomas, 2019-04-09) was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The current code at SSIPrintenv.java:38 properly applies HTML entit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.50 is not affected by CVE-2019-0232. The vulnerability's fix (commit 4b244d827a) was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix adds validation of URL-decoded command line arguments against a restrictive character pattern on Windows, preventing command injection when enableCmdLineArguments is enabled. The vulnerable code pattern (accepting arbitrary decoded arguments without validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "The target Apache Tomcat 10.1.50 is not affected by CVE-2019-0232. The vulnerability's fix (commit 4b244d827a) was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix adds validation of URL-decoded command line arguments against a restrictive character pattern on Windows, preventing command injection when enableCmdLineArguments is enabled. The vulnerable code pattern (accepting arbitrary decoded arguments without validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.50 is not affected by CVE-2019-10072. The vulnerability (HTTP/2 connection window exhaustion causing indefinite thread blocking and DoS) was fixed in upstream commit 7f748eb6bf authored by Apache committer Mark Thomas on 2019-05-03. This fix was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The fix adds timeout handling when waiting for connection window allocation, preventing indefinite blocking and thread exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "The target Apache Tomcat 10.1.50 is not affected by CVE-2019-10072. The vulnerability (HTTP/2 connection window exhaustion causing indefinite thread blocking and DoS) was fixed in upstream commit 7f748eb6bf authored by Apache committer Mark Thomas on 2019-05-03. This fix was already included in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The fix adds timeout handling when waiting for connection window allocation, preventing indefinite blocking and thread exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 affects the JmxRemoteLifecycleListener component in Tomcat versions 9.0.0.M1-9.0.28, 8.5.0-8.5.47, and 7.0.0-7.0.97. This component allowed local attackers to manipulate the RMI registry for man-in-the-middle attacks to capture JMX credentials. However, the JmxRemoteLifecycleListener component was deprecated and completely removed by upstream Apache Tomcat in January 2020 (commit 46fbf32e55) by Mark Thomas. This removal was included in Tomcat 10.0.0 (released December 2020), well before Tomcat 10.1.50 was released. The target repository (version 10.1.50) never contained this vulnerable component - it was already absent from the upstream release when TuxCare onboarded this version in October 2024. The vulnerability cannot manifest because the entire attack surface (the JmxRemoteLifecycleListener class and its mutable RMI registry creation) does not exist in this codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 affects the JmxRemoteLifecycleListener component in Tomcat versions 9.0.0.M1-9.0.28, 8.5.0-8.5.47, and 7.0.0-7.0.97. This component allowed local attackers to manipulate the RMI registry for man-in-the-middle attacks to capture JMX credentials. However, the JmxRemoteLifecycleListener component was deprecated and completely removed by upstream Apache Tomcat in January 2020 (commit 46fbf32e55) by Mark Thomas. This removal was included in Tomcat 10.0.0 (released December 2020), well before Tomcat 10.1.50 was released. The target repository (version 10.1.50) never contained this vulnerable component - it was already absent from the upstream release when TuxCare onboarded this version in October 2024. The vulnerability cannot manifest because the entire attack surface (the JmxRemoteLifecycleListener class and its mutable RMI registry creation) does not exist in this codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 (session fixation vulnerability in FORM authentication) is NOT present in Tomcat 10.1.50. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 1ecba14e690cf5f3f143eef6ae7037a6d3c16652 (2019-12-05) and was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it (commit 8f04542b9a, 2024-06-14). The vulnerable pattern (premature cached authentication check enabling session fixation) has been removed. Additional hardening via session ID validation (commit fd381e94f2) is also present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 (session fixation vulnerability in FORM authentication) is NOT present in Tomcat 10.1.50. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 1ecba14e690cf5f3f143eef6ae7037a6d3c16652 (2019-12-05) and was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it (commit 8f04542b9a, 2024-06-14). The vulnerable pattern (premature cached authentication check enabling session fixation) has been removed. Additional hardening via session ID validation (commit fd381e94f2) is also present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:25:43.115991+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.50 is not affected by CVE-2019-17569. The vulnerability involved a regression in Transfer-Encoding header parsing (introduced in 7.0.98, 8.5.48, 9.0.28) where invalid tokens were silently ignored instead of rejected, potentially enabling HTTP Request Smuggling. The fix was authored by upstream Apache Tomcat (Mark Thomas, commit 3c295d913e on 2019-12-17) and shipped with the u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.50 is not affected by CVE-2019-17569. The vulnerability involved a regression in Transfer-Encoding header parsing (introduced in 7.0.98, 8.5.48, 9.0.28) where invalid tokens were silently ignored instead of rejected, potentially enabling HTTP Request Smuggling. The fix was authored by upstream Apache Tomcat (Mark Thomas, commit 3c295d913e on 2019-12-17) and shipped with the u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-11996 describes a DoS vulnerability in Apache Tomcat's HTTP/2 implementation where specially crafted requests with large stream IDs cause high CPU usage. The vulnerable code pattern (inefficient O(n) iteration in closeIdleStreams method) does not exist in target version 10.1.50. The entire implicit idle stream closing mechanism was removed in upstream commit 043d6581b8 (Sept 2024) because \"Tomcat never creates streams in the idle state without immediately transitioning them to open.\" This architectural change shipped in the upstream release that TuxCare onboarded, eliminating the vulnerability pattern entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 describes a DoS vulnerability in Apache Tomcat's HTTP/2 implementation where specially crafted requests with large stream IDs cause high CPU usage. The vulnerable code pattern (inefficient O(n) iteration in closeIdleStreams method) does not exist in target version 10.1.50. The entire implicit idle stream closing mechanism was removed in upstream commit 043d6581b8 (Sept 2024) because \"Tomcat never creates streams in the idle state without immediately transitioning them to open.\" This architectural change shipped in the upstream release that TuxCare onboarded, eliminating the vulnerability pattern entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:58:56.128088+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Tomcat 10.1.50 is not affected by CVE-2020-1935. The vulnerability (improper HTTP header parsing allowing request smuggling via malformed CRLF sequences and control characters) was fixed in upstream Tomcat 9.0.31 (January 2020). The fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The vulnerable pattern does not exist in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 10.1.50 is not affected by CVE-2020-1935. The vulnerability (improper HTTP header parsing allowing request smuggling via malformed CRLF sequences and control characters) was fixed in upstream Tomcat 9.0.31 (January 2020). The fix was already present in the upstream Tomcat 10.1.50 release that TuxCare onboarded. The vulnerable pattern does not exist in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.50 is not affected by CVE-2020-1938 (Ghostcat). The vulnerability affected versions up to 9.0.30/8.5.50/7.0.99 and was fixed in January 2020. Tomcat 10.1.x line was created in June 2021, 18 months after the fix, and inherited all security defenses from upstream Apache. The target version ships with: (1) AJP connector disabled by default, (2) loopback-only binding when enabled, (3) mandatory secret validation, and (4) request attribute validation. These defenses prevent arbitrary file access and JSP execution via malicious AJP requests. No TuxCare backport exists for 10.1.50 because the version was never vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "Tomcat 10.1.50 is not affected by CVE-2020-1938 (Ghostcat). The vulnerability affected versions up to 9.0.30/8.5.50/7.0.99 and was fixed in January 2020. Tomcat 10.1.x line was created in June 2021, 18 months after the fix, and inherited all security defenses from upstream Apache. The target version ships with: (1) AJP connector disabled by default, (2) loopback-only binding when enabled, (3) mandatory secret validation, and (4) request attribute validation. These defenses prevent arbitrary file access and JSP execution via malicious AJP requests. No TuxCare backport exists for 10.1.50 because the version was never vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-9484 is not present in Apache Tomcat 10.1.50. The vulnerability, which allowed path traversal in session IDs to deserialize arbitrary files via FileStore, was fixed by Apache upstream in May 2020 (commit bb33048e3f). This fix was already included in version 10.1.50 when TuxCare onboarded it in September 2026. The FileStore.java file contains complete path validation at lines 324-328 that prevents session IDs with path traversal sequences from accessing files outside the configured storage directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 is not present in Apache Tomcat 10.1.50. The vulnerability, which allowed path traversal in session IDs to deserialize arbitrary files via FileStore, was fixed by Apache upstream in May 2020 (commit bb33048e3f). This fix was already included in version 10.1.50 when TuxCare onboarded it in September 2026. The FileStore.java file contains complete path validation at lines 324-328 that prevents session IDs with path traversal sequences from accessing files outside the configured storage directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 affects Tomcat 10.0.0-M1 to 10.0.0-M9. The target version 10.1.50 is newer and contains the upstream Apache fix (commit 7f004ac4531c45f9a2a2d1470561fe135cf27bc2 by Mark Thomas) that was already present in the release when TuxCare onboarded it. The fix adds ':' character validation in isInvalidWindowsFilename() to prevent File.getCanonicalPath() from producing unexpected results o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 affects Tomcat 10.0.0-M1 to 10.0.0-M9. The target version 10.1.50 is newer and contains the upstream Apache fix (commit 7f004ac4531c45f9a2a2d1470561fe135cf27bc2 by Mark Thomas) that was already present in the release when TuxCare onboarded it. The fix adds ':' character validation in isInvalidWindowsFilename() to prevent File.getCanonicalPath() from producing unexpected results o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 is NOT present in Apache Tomcat 10.1.50. All three upstream fixes for BZ 64830 are already applied: (1) HpackDecoder uses method-local StringBuilder instead of shared instance field, preventing concurrent request contamination; (2) AbstractProtocol restores leftover input to wrapper before creating h2c processor; (3) HTTP/1.1 processor is properly released during h2c upgrade. All fixes were authored by upstream Apache (markt@apache.org) and shipped in upstream release 10.1.50, which TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 is NOT present in Apache Tomcat 10.1.50. All three upstream fixes for BZ 64830 are already applied: (1) HpackDecoder uses method-local StringBuilder instead of shared instance field, preventing concurrent request contamination; (2) AbstractProtocol restores leftover input to wrapper before creating h2c processor; (3) HTTP/1.1 processor is properly released during h2c upgrade. All fixes were authored by upstream Apache (markt@apache.org) and shipped in upstream release 10.1.50, which TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.50 is not affected by CVE-2021-25329. The vulnerability involved unsafe directory traversal checks using string-based path comparison (getCanonicalPath().startsWith(String)). The fix, which replaces string comparison with java.nio.file.Path-based comparison (toPath().startsWith(Path)), was already present in the upstream Apache Tomcat 10.1.50 release. All affected files (FileStore.java, ExpandWar.java, DefaultServlet.java, ContextConfig.java, HostConfig.java) contain the fixed pattern. The vulnerable pattern does not exist anywhere in the codebase. Fix commit 6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4 by upstream author markt@apache.org was included before TuxCare onboarded version 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "Apache Tomcat 10.1.50 is not affected by CVE-2021-25329. The vulnerability involved unsafe directory traversal checks using string-based path comparison (getCanonicalPath().startsWith(String)). The fix, which replaces string comparison with java.nio.file.Path-based comparison (toPath().startsWith(Path)), was already present in the upstream Apache Tomcat 10.1.50 release. All affected files (FileStore.java, ExpandWar.java, DefaultServlet.java, ContextConfig.java, HostConfig.java) contain the fixed pattern. The vulnerable pattern does not exist anywhere in the codebase. Fix commit 6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4 by upstream author markt@apache.org was included before TuxCare onboarded version 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 is not present in Apache Tomcat 10.1.50. The vulnerability (request smuggling via invalid Content-Length headers when rejectIllegalHeader=false) was fixed in the upstream Apache Tomcat 10.1.50 release. The fix at Http11InputBuffer.java:1034-1037 ensures malformed Content-Length headers are always rejected regardless of rejectIllegalHeader configuration, by checking the header name and forcing rejection. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "CVE-2022-42252 is not present in Apache Tomcat 10.1.50. The vulnerability (request smuggling via invalid Content-Length headers when rejectIllegalHeader=false) was fixed in the upstream Apache Tomcat 10.1.50 release. The fix at Http11InputBuffer.java:1034-1037 ensures malformed Content-Length headers are always rejected regardless of rejectIllegalHeader configuration, by checking the header name and forcing rejection. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-45143: The target is NOT affected. The vulnerability (missing JSON escaping in JsonErrorReportValve for type/message/description fields) was fixed by upstream Apache Tomcat in commit 1f50bff8daabb48c5f15398689988f26aac6ec56 (author: Mark Thomas, markt@apache.org, Nov 9 2022). This fix was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it via commit 8f04542b9a2881ccb651bfb2518a0f2745687b8c. The current HEAD contains JSONFilter.escape() protecting all three vulnerable fields, eliminating the JSON injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143: The target is NOT affected. The vulnerability (missing JSON escaping in JsonErrorReportValve for type/message/description fields) was fixed by upstream Apache Tomcat in commit 1f50bff8daabb48c5f15398689988f26aac6ec56 (author: Mark Thomas, markt@apache.org, Nov 9 2022). This fix was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it via commit 8f04542b9a2881ccb651bfb2518a0f2745687b8c. The current HEAD contains JSONFilter.escape() protecting all three vulnerable fields, eliminating the JSON injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 fix is present and active in Apache Tomcat 10.1.50. The vulnerability concerns unbounded processing of multipart/form-data request parts leading to DoS. The upstream fix adds a fileCountMax limit with default enforcement via maxParameterCount (10,000 parts). This fix was included in the upstream Apache Tomcat 10.1.50 release (committed Dec 13, 2022 by markt@apache.org) before TuxCare onboarded the version on Sep 20, 2026 (commit 8f04542b9a). No separate TuxCare backport was needed for 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 fix is present and active in Apache Tomcat 10.1.50. The vulnerability concerns unbounded processing of multipart/form-data request parts leading to DoS. The upstream fix adds a fileCountMax limit with default enforcement via maxParameterCount (10,000 parts). This fix was included in the upstream Apache Tomcat 10.1.50 release (committed Dec 13, 2022 by markt@apache.org) before TuxCare onboarded the version on Sep 20, 2026 (commit 8f04542b9a). No separate TuxCare backport was needed for 10.1.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 (parameter counting bypass) is NOT present in target Apache Tomcat 10.1.50. The fix (commit ba848da71c by Mark Thomas) was already included in the upstream 10.1.50 release that TuxCare onboarded. The vulnerable pattern (incrementing parameterCount before checking the limit, using > instead of >=) does not exist in the target code. The current code correctly checks if parameterCount >= limit BEFORE incrementing, preventing the off-by-one error that allowed bypassing maxParameterCount when exactly that many parameters were supplied in the query string.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "CVE-2023-28709 (parameter counting bypass) is NOT present in target Apache Tomcat 10.1.50. The fix (commit ba848da71c by Mark Thomas) was already included in the upstream 10.1.50 release that TuxCare onboarded. The vulnerable pattern (incrementing parameterCount before checking the limit, using > instead of >=) does not exist in the target code. The current code correctly checks if parameterCount >= limit BEFORE incrementing, preventing the off-by-one error that allowed bypassing maxParameterCount when exactly that many parameters were supplied in the query string.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-34981 is not present in Apache Tomcat 10.1.50. The vulnerability (a regression in the bug 66512 fix that prevented AJP SEND_HEADERS messages from being sent for responses with no headers, causing mod_proxy_ajp to reuse headers from previous requests) was fixed by upstream Apache in commit f0742f47b9 (bug 66591) on May 3, 2023, before the 10.1.50 release. TuxCare onboarded version 10.1.50 with the fix already included. The target code implements the defense via a while loop that ensures SEND_HEADERS is sent unconditionally, even when the response has zero headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "CVE-2023-34981 is not present in Apache Tomcat 10.1.50. The vulnerability (a regression in the bug 66512 fix that prevented AJP SEND_HEADERS messages from being sent for responses with no headers, causing mod_proxy_ajp to reuse headers from previous requests) was fixed by upstream Apache in commit f0742f47b9 (bug 66591) on May 3, 2023, before the 10.1.50 release. TuxCare onboarded version 10.1.50 with the fix already included. The target code implements the defense via a while loop that ensures SEND_HEADERS is sent unconditionally, even when the response has zero headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T00:53:04.614804+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.50. The fix was already included in the upstream Apache Tomcat 10.1.50 release (commit bb4624a9f3 by Mark Thomas, dated Aug 22, 2023) before TuxCare onboarded this version. The vulnerable pattern - lack of protection against protocol-relative redirects (URLs starting with //) in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.50. The fix was already included in the upstream Apache Tomcat 10.1.50 release (commit bb4624a9f3 by Mark Thomas, dated Aug 22, 2023) before TuxCare onboarded this version. The vulnerable pattern - lack of protection against protocol-relative redirects (URLs starting with //) in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:25:50.594919+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in the target. The upstream Apache Tomcat fix (commit 76bb4bfbfe by Mark Thomas, Oct 5 2023) was already included in version 10.1.50 when TuxCare onboarded it. The defense tracks RST_STREAM frames with a 50x overhead penalty (overheadResetFactor=50), PRIORITY_UPDATE frames, and stops processing when the overhead limit is exceeded. All protections are enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in the target. The upstream Apache Tomcat fix (commit 76bb4bfbfe by Mark Thomas, Oct 5 2023) was already included in version 10.1.50 when TuxCare onboarded it. The defense tracks RST_STREAM frames with a 50x overhead penalty (overheadResetFactor=50), PRIORITY_UPDATE frames, and stops processing when the overhead limit is exceeded. All protections are enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:11:13.689447+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.50 is NOT AFFECTED by CVE-2023-45648. The upstream Apache Tomcat 10.1.50 release already contained the fix for improper HTTP trailer header validation. The vulnerability (unvalidated trailer headers enabling request smuggling) is not present because the code includes HttpHeaderParser with proper validation that rejects non-token characters in header names and control charact...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.50 is NOT AFFECTED by CVE-2023-45648. The upstream Apache Tomcat 10.1.50 release already contained the fix for improper HTTP trailer header validation. The vulnerability (unvalidated trailer headers enabling request smuggling) is not present because the code includes HttpHeaderParser with proper validation that rejects non-token characters in header names and control charact..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.50 is not vulnerable to CVE-2023-46589. The target version is after the fixed version 10.1.16. The vulnerability (improper HTTP trailer header validation leading to request smuggling) is not present because the target uses a refactored HttpHeaderParser class introduced by upstream Apache in April 2024 that includes the required validation. The fix was part of the upstream 10.1.50 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "Apache Tomcat 10.1.50 is not vulnerable to CVE-2023-46589. The target version is after the fixed version 10.1.16. The vulnerability (improper HTTP trailer header validation leading to request smuggling) is not present because the target uses a refactored HttpHeaderParser class introduced by upstream Apache in April 2024 that includes the required validation. The fix was part of the upstream 10.1.50 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:43:00.122669+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 is not present in Tomcat 10.1.50. The vulnerability affects versions 8.5.7-8.5.63 and 9.0.0-M11-9.0.43, and was fixed in 8.5.64+ and 9.0.44+. The target version 10.1.50 is significantly newer and already contains the upstream fix (commit ce4f9a5e by Mark Thomas, Feb 2021) that prevents information disclosure by checking if I/O is allowed before attempting to write error reports. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 is not present in Tomcat 10.1.50. The vulnerability affects versions 8.5.7-8.5.63 and 9.0.0-M11-9.0.43, and was fixed in 8.5.64+ and 9.0.44+. The target version 10.1.50 is significantly newer and already contains the upstream fix (commit ce4f9a5e by Mark Thomas, Feb 2021) that prevents information disclosure by checking if I/O is allowed before attempting to write error reports. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.50 is not affected by CVE-2024-24549. The vulnerability affects versions up to 10.1.18, and was fixed by Apache in version 10.1.19. The target version 10.1.50 was onboarded with the upstream vendor fix already present. The fix moves HTTP/2 header validation from the end of header processing to the end of each frame (HEADERS and CONTINUATION), preventing resource exhaustion from processing excessive headers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "Apache Tomcat 10.1.50 is not affected by CVE-2024-24549. The vulnerability affects versions up to 10.1.18, and was fixed by Apache in version 10.1.19. The target version 10.1.50 was onboarded with the upstream vendor fix already present. The fix moves HTTP/2 header validation from the end of header processing to the end of each frame (HEADERS and CONTINUATION), preventing resource exhaustion from processing excessive headers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 10.1.50) is NOT affected by CVE-2024-34750. The vulnerability involves incorrect active HTTP/2 stream counting that could lead to connections remaining open indefinitely. The upstream fix (commit 2afae300c9 by Mark Thomas) shipped in Apache Tomcat 10.1.25 and is present in this 10.1.50 version. The fix adds idempotency protection using AtomicBoolean compare-and-set to ensure each stream is removed from the active count exactly once, preventing miscounting. All fix components are present and properly integrated in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "impact_statement": "The target repository (Apache Tomcat 10.1.50) is NOT affected by CVE-2024-34750. The vulnerability involves incorrect active HTTP/2 stream counting that could lead to connections remaining open indefinitely. The upstream fix (commit 2afae300c9 by Mark Thomas) shipped in Apache Tomcat 10.1.25 and is present in this 10.1.50 version. The fix adds idempotency protection using AtomicBoolean compare-and-set to ensure each stream is removed from the active count exactly once, preventing miscounting. All fix components are present and properly integrated in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2024-38286. The fix for this TLS handshake resource exhaustion vulnerability was already present in the upstream Apache Tomcat 10.1.50 release. The defense mechanisms (HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT counter in SecureNio2Channel and needHandshakeWrap flag in SecureNioChannel) were introduced by upstream commit 3344c17cef094da4bb616f4186ed32039627b543 authored by Mark Thomas (markt@apache.org), which shipped with the release before TuxCare onboarded it. No TuxCare backport for this CVE to version 10.1.50 exists because the fix was already present in the upstream code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "impact_statement": "Target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2024-38286. The fix for this TLS handshake resource exhaustion vulnerability was already present in the upstream Apache Tomcat 10.1.50 release. The defense mechanisms (HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT counter in SecureNio2Channel and needHandshakeWrap flag in SecureNioChannel) were introduced by upstream commit 3344c17cef094da4bb616f4186ed32039627b543 authored by Mark Thomas (markt@apache.org), which shipped with the release before TuxCare onboarded it. No TuxCare backport for this CVE to version 10.1.50 exists because the fix was already present in the upstream code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:13.268056+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.50 (target version) shipped with the complete CVE-2024-50379 fix already applied by upstream. The vulnerability pattern (TOCTOU race during JSP compilation on case-insensitive filesystems) is not present because the upstream release included comprehensive locking (WebResourceLockSet interface, ReentrantReadWriteLock on normalized/lowercased paths) that prevents concurrent file access corruption. TuxCare onboarded an already-fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "impact_statement": "Apache Tomcat 10.1.50 (target version) shipped with the complete CVE-2024-50379 fix already applied by upstream. The vulnerability pattern (TOCTOU race during JSP compilation on case-insensitive filesystems) is not present because the upstream release included comprehensive locking (WebResourceLockSet interface, ReentrantReadWriteLock on normalized/lowercased paths) that prevents concurrent file access corruption. TuxCare onboarded an already-fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:35:21.882986+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-52317 is NOT present in Apache Tomcat 10.1.50. The vulnerability (incorrect recycling of HTTP/2 request/response objects leading to data mix-up between users) was fixed in upstream version 10.1.31. The target version 10.1.50 includes the complete upstream fix: Stream.recycle() is split into replace() and recycle(), with double-checked locking preventing duplicate recycling. This fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-52317 is NOT present in Apache Tomcat 10.1.50. The vulnerability (incorrect recycling of HTTP/2 request/response objects leading to data mix-up between users) was fixed in upstream version 10.1.31. The target version 10.1.50 includes the complete upstream fix: Stream.recycle() is split into replace() and recycle(), with double-checked locking preventing duplicate recycling. This fix wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.50 is NOT affected by CVE-2024-56337. The complete upstream fix authored by Mark Thomas (markt@apache.org) was already present in the Apache Tomcat 10.1.50 release when TuxCare onboarded it. The fix includes: (1) runtime checks in DirResourceSet.initInternal() that verify canonical caches are disabled on vulnerable configurations and prevent startup if they cannot be disabled, (2) JreCompat methods isCanonCachesDisabled() and disableCanonCaches() using reflection to access java.io.FileSystem.useCanonCaches, and (3) startup scripts (catalina.sh/catalina.bat) that set -Dsun.io.useCanonCaches=false by default. The vulnerable pattern (uncontrolled canonical path caching on case-insensitive filesystems with write-enabled default servlet) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "impact_statement": "Target Tomcat 10.1.50 is NOT affected by CVE-2024-56337. The complete upstream fix authored by Mark Thomas (markt@apache.org) was already present in the Apache Tomcat 10.1.50 release when TuxCare onboarded it. The fix includes: (1) runtime checks in DirResourceSet.initInternal() that verify canonical caches are disabled on vulnerable configurations and prevent startup if they cannot be disabled, (2) JreCompat methods isCanonCachesDisabled() and disableCanonCaches() using reflection to access java.io.FileSystem.useCanonCaches, and (3) startup scripts (catalina.sh/catalina.bat) that set -Dsun.io.useCanonCaches=false by default. The vulnerable pattern (uncontrolled canonical path caching on case-insensitive filesystems with write-enabled default servlet) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-24813 (Path Equivalence via Internal Dot in partial PUT temp files) is NOT present in the target. The vulnerable pattern\u2014predictable temporary file naming using path.replace('/', '.')\u2014was already fixed in the upstream Apache Tomcat 10.1.50 release. The target uses File.createTempFile() to generate unpredictable random temp file names and deletes them immediately after processing, implementing both security measures from the upstream patch authored by remm@apache.org on 2025-01-24.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "impact_statement": "CVE-2025-24813 (Path Equivalence via Internal Dot in partial PUT temp files) is NOT present in the target. The vulnerable pattern\u2014predictable temporary file naming using path.replace('/', '.')\u2014was already fixed in the upstream Apache Tomcat 10.1.50 release. The target uses File.createTempFile() to generate unpredictable random temp file names and deletes them immediately after processing, implementing both security measures from the upstream patch authored by remm@apache.org on 2025-01-24.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-31650 affects Apache Tomcat versions 10.1.10 through 10.1.39. The target version 10.1.50 is not affected because all three security fixes for this CVE were already included in the upstream Apache Tomcat 10.1.40 release (April 2025), which predates 10.1.50 (December 2025). The fixes were authored by Mark Thomas (markt@apache.org), an upstream Apache committer, and shipped in the official 10.1.50 release before TuxCare onboarded the version in September 2026. No TuxCare backport was necessary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "CVE-2025-31650 affects Apache Tomcat versions 10.1.10 through 10.1.39. The target version 10.1.50 is not affected because all three security fixes for this CVE were already included in the upstream Apache Tomcat 10.1.40 release (April 2025), which predates 10.1.50 (December 2025). The fixes were authored by Mark Thomas (markt@apache.org), an upstream Apache committer, and shipped in the official 10.1.50 release before TuxCare onboarded the version in September 2026. No TuxCare backport was necessary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-31651 affects Apache Tomcat's RewriteValve, where URLs containing literal '%', ';', or '?' characters could bypass rewrite rules due to improper handling of escape sequences. The target repository (Apache Tomcat 10.1.50) is NOT AFFECTED because the upstream Apache fix (commit 066bf6b6a15 by Mark Thomas, dated 2025-03-13) was already included in the 10.1.50 release when TuxCare onboarded it. The fix adds an encodeForRewrite() method that pre-encodes literal special characters before rewrite rule evaluation, preventing bypass attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "impact_statement": "CVE-2025-31651 affects Apache Tomcat's RewriteValve, where URLs containing literal '%', ';', or '?' characters could bypass rewrite rules due to improper handling of escape sequences. The target repository (Apache Tomcat 10.1.50) is NOT AFFECTED because the upstream Apache fix (commit 066bf6b6a15 by Mark Thomas, dated 2025-03-13) was already included in the 10.1.50 release when TuxCare onboarded it. The fix adds an encodeForRewrite() method that pre-encodes literal special characters before rewrite rule evaluation, preventing bypass attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-46701 does not affect Apache Tomcat 10.1.50-tuxcare.2. The vulnerability fix was already present in the upstream Apache Tomcat 10.1.50 release when TuxCare onboarded it. The target code contains the security fix (isFile() validation in CGIServlet.findCGI) introduced by upstream commit 238d2aa54b (Mark Thomas, 2025-05-02), which predates the TuxCare onboarding commit 8f04542b9a (2026-09-20). Version 10.1.50 exceeds the first fixed version 10.1.41 specified in the CVE advisory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "impact_statement": "CVE-2025-46701 does not affect Apache Tomcat 10.1.50-tuxcare.2. The vulnerability fix was already present in the upstream Apache Tomcat 10.1.50 release when TuxCare onboarded it. The target code contains the security fix (isFile() validation in CGIServlet.findCGI) introduced by upstream commit 238d2aa54b (Mark Thomas, 2025-05-02), which predates the TuxCare onboarding commit 8f04542b9a (2026-09-20). Version 10.1.50 exceeds the first fixed version 10.1.41 specified in the CVE advisory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-48988 is NOT present in Apache Tomcat 10.1.50. The upstream fix that adds maxPartCount and maxPartHeaderSize limits to prevent resource exhaustion during multipart request processing is already present in the target version. The fix was authored by Mark Thomas (Apache upstream) in commit cdde8e655bc1c5c60a07efd216251d77c52fd7f6 and is part of the 10.1.50 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "impact_statement": "CVE-2025-48988 is NOT present in Apache Tomcat 10.1.50. The upstream fix that adds maxPartCount and maxPartHeaderSize limits to prevent resource exhaustion during multipart request processing is already present in the target version. The fix was authored by Mark Thomas (Apache upstream) in commit cdde8e655bc1c5c60a07efd216251d77c52fd7f6 and is part of the 10.1.50 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:13.268056+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-48989 (made you reset attack) is NOT present in Tomcat 10.1.50-tuxcare.2. The upstream fix was already included in Tomcat 10.1.50 when TuxCare onboarded it. The vulnerability allowed attackers to exhaust server resources by triggering server-initiated RST_STREAM frames that were not properly tracked in the HTTP/2 overhead protection system. The fix adds overhead counting when the server SENDS reset frames (not just when receiving them), preventing resource exhaustion. Fix commit 73c04a10395774bda71a0b37802cf983662ce255 by Mark Thomas was shipped in the upstream Tomcat 10.1.50 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108; >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108), NVD (>= 9.0.1, < 9.0.108; >= 10.0.0, < 10.1.44; >= 11.0.0, < 11.0.10; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.9; >= 10.1.0-M1, <= 10.1.43; >= 9.0.0.M1, <= 9.0.107), Snyk (>= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10; >= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "impact_statement": "CVE-2025-48989 (made you reset attack) is NOT present in Tomcat 10.1.50-tuxcare.2. The upstream fix was already included in Tomcat 10.1.50 when TuxCare onboarded it. The vulnerability allowed attackers to exhaust server resources by triggering server-initiated RST_STREAM frames that were not properly tracked in the HTTP/2 overhead protection system. The fix adds overhead counting when the server SENDS reset frames (not just when receiving them), preventing resource exhaustion. Fix commit 73c04a10395774bda71a0b37802cf983662ce255 by Mark Thomas was shipped in the upstream Tomcat 10.1.50 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108; >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108), NVD (>= 9.0.1, < 9.0.108; >= 10.0.0, < 10.1.44; >= 11.0.0, < 11.0.10; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.9; >= 10.1.0-M1, <= 10.1.43; >= 9.0.0.M1, <= 9.0.107), Snyk (>= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10; >= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-49124. The upstream fix (commit e0e0781222 by Mark Thomas) that adds full path $SYSDIR\\ prefix to all icacls.exe calls was already included in the Apache Tomcat 10.1.50 release. TuxCare onboarded version 10.1.50 which already contained this upstream security fix. All three icacls invocations in res/install-win/tomcat.nsi (lines 382, 395, 408) correctly use '$SYSDIR\\icacls' instead of the vulnerable bare 'icacls' pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "impact_statement": "The target Apache Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-49124. The upstream fix (commit e0e0781222 by Mark Thomas) that adds full path $SYSDIR\\ prefix to all icacls.exe calls was already included in the Apache Tomcat 10.1.50 release. TuxCare onboarded version 10.1.50 which already contained this upstream security fix. All three icacls invocations in res/install-win/tomcat.nsi (lines 382, 395, 408) correctly use '$SYSDIR\\icacls' instead of the vulnerable bare 'icacls' pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.50 already contains the upstream Apache Tomcat fix for CVE-2025-49125. The vulnerable path.startsWith(webAppMount) pattern has been replaced with the secure isPathMounted() method that enforces proper path boundary checking. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 7617b9c247bc77ed0444dd69adcd8aa48777886c and was included in upstream version 10.1.42. Since 10.1.50 > 10.1.42, the fix was already present when TuxCare onboarded this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "impact_statement": "Target version 10.1.50 already contains the upstream Apache Tomcat fix for CVE-2025-49125. The vulnerable path.startsWith(webAppMount) pattern has been replaced with the secure isPathMounted() method that enforces proper path boundary checking. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 7617b9c247bc77ed0444dd69adcd8aa48777886c and was included in upstream version 10.1.42. Since 10.1.50 > 10.1.42, the fix was already present when TuxCare onboarded this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-52434 affects the APR/Native connector (AprEndpoint.java) which was removed from Apache Tomcat 10.x in August 2021 (commit 314568fa45). Version 10.1.50 uses only NIO and NIO2 connectors, which have fundamentally different architectures (standard Java sockets vs APR native JNI calls) and do not exhibit the JVM crash risk that the CVE addresses. The vulnerable component has never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "impact_statement": "CVE-2025-52434 affects the APR/Native connector (AprEndpoint.java) which was removed from Apache Tomcat 10.x in August 2021 (commit 314568fa45). Version 10.1.50 uses only NIO and NIO2 connectors, which have fundamentally different architectures (standard Java sockets vs APR native JNI calls) and do not exhibit the JVM crash risk that the CVE addresses. The vulnerable component has never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-52520 (Integer Overflow in Apache Tomcat multipart upload) is NOT present in target version 10.1.50. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.42 and was fixed in 10.1.43. The target version 10.1.50 was released upstream AFTER the fix was applied (fix date: 2025-07-01; onboarding date: 2026-09-20). The fix (changing int postSize to long postSize with Math.addExact overflow detection) was already present in the upstream Apache Tomcat 10.1.50 release when TuxCare onboarded it. Fix commit fc42bbccb9041fafd194fbfdf3eab1d44cb5c45c by upstream author Mark Thomas (markt@apache.org) is confirmed present at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107; >= 10.1.0, < 10.1.43; >= 11.0.0, < 11.0.9), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "impact_statement": "CVE-2025-52520 (Integer Overflow in Apache Tomcat multipart upload) is NOT present in target version 10.1.50. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.42 and was fixed in 10.1.43. The target version 10.1.50 was released upstream AFTER the fix was applied (fix date: 2025-07-01; onboarding date: 2026-09-20). The fix (changing int postSize to long postSize with Math.addExact overflow detection) was already present in the upstream Apache Tomcat 10.1.50 release when TuxCare onboarded it. Fix commit fc42bbccb9041fafd194fbfdf3eab1d44cb5c45c by upstream author Mark Thomas (markt@apache.org) is confirmed present at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107; >= 10.1.0, < 10.1.43; >= 11.0.0, < 11.0.9), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:13.268056+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-53506 is NOT present in this target. The vulnerability fix was already included in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix (commit 2aa6261276 by markt@apache.org) enforces HTTP/2 connection limits (MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE) immediately upon connection initialization, without waiting for client ACK of the SETTINGS frame. This prevents malicious clients from bypassing stream limits by refusing to acknowledge settings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9), NVD (>= 9.0.0, <= 9.0.106; >= 10.1.0, <= 10.1.42; >= 11.0.0, <= 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-53506"
      },
      "impact_statement": "CVE-2025-53506 is NOT present in this target. The vulnerability fix was already included in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded. The fix (commit 2aa6261276 by markt@apache.org) enforces HTTP/2 connection limits (MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE) immediately upon connection initialization, without waiting for client ACK of the SETTINGS frame. This prevents malicious clients from bypassing stream limits by refusing to acknowledge settings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9), NVD (>= 9.0.0, <= 9.0.106; >= 10.1.0, <= 10.1.42; >= 11.0.0, <= 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T20:40:53.651459+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 10.1.50-tuxcare.2 is not affected by CVE-2025-55668. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and the target version 10.1.50 already contains the complete upstream fix. The fix (commit 8621e4c6ba by remm@apache.org) was shipped in the upstream 10.1.50 release that TuxCare onboarded, not backported by TuxCare. Both critical components of the fix are pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 10.1.50-tuxcare.2 is not affected by CVE-2025-55668. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and the target version 10.1.50 already contains the complete upstream fix. The fix (commit 8621e4c6ba by remm@apache.org) was shipped in the upstream 10.1.50 release that TuxCare onboarded, not backported by TuxCare. Both critical components of the fix are pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 10.1.50 repository is NOT AFFECTED by CVE-2025-55752. The vulnerability involved incorrect URL processing order in RewriteValve where normalization occurred before decoding, allowing attackers to bypass security constraints for /WEB-INF/ and /META-INF/ using percent-encoded paths. The fix (decode-then-normalize) was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded, authored by Mark Thomas (markt@apache.org) in commit 130d36d8492ef9e4eb22952c17c92423cb35fd06. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "impact_statement": "The target Tomcat 10.1.50 repository is NOT AFFECTED by CVE-2025-55752. The vulnerability involved incorrect URL processing order in RewriteValve where normalization occurred before decoding, allowing attackers to bypass security constraints for /WEB-INF/ and /META-INF/ using percent-encoded paths. The fix (decode-then-normalize) was already present in the upstream Apache Tomcat 10.1.50 release that TuxCare onboarded, authored by Mark Thomas (markt@apache.org) in commit 130d36d8492ef9e4eb22952c17c92423cb35fd06. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-55754 is NOT present in Tomcat 10.1.50. The vulnerability (ANSI escape sequences in log messages allowing console manipulation) was fixed by upstream Apache in commit 138d7f5cfa which added LogUtil.escape() to sanitize control characters. This fix was already included in the Apache Tomcat 10.1.50 release that TuxCare onboarded. The defense escapes all control characters (except tab, newline, carriage return) to Java \\uNNNN format before writing to log output, preventing console manipulation attacks. Fix author: Mark Thomas <markt@apache.org> (upstream Apache, not TuxCare backport).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "impact_statement": "CVE-2025-55754 is NOT present in Tomcat 10.1.50. The vulnerability (ANSI escape sequences in log messages allowing console manipulation) was fixed by upstream Apache in commit 138d7f5cfa which added LogUtil.escape() to sanitize control characters. This fix was already included in the Apache Tomcat 10.1.50 release that TuxCare onboarded. The defense escapes all control characters (except tab, newline, carriage return) to Java \\uNNNN format before writing to log output, preventing console manipulation attacks. Fix author: Mark Thomas <markt@apache.org> (upstream Apache, not TuxCare backport).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:18:45.160348+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-61795. The vulnerability (temporary file accumulation from failed multipart uploads) has been fixed by upstream Apache Tomcat. The fix commit af6e918162 by Mark Thomas (markt@apache.org) was included in the upstream 10.1.50 release that TuxCare onboarded. The CVE states versions 10.1.47+ are fixed, and 10.1.50 meets this requirement. The def...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-61795"
      },
      "impact_statement": "not_affected \u2014 The target Tomcat 10.1.50 is NOT AFFECTED by CVE-2025-61795. The vulnerability (temporary file accumulation from failed multipart uploads) has been fixed by upstream Apache Tomcat. The fix commit af6e918162 by Mark Thomas (markt@apache.org) was included in the upstream 10.1.50 release that TuxCare onboarded. The CVE states versions 10.1.47+ are fixed, and 10.1.50 meets this requirement. The def..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.50 is NOT AFFECTED by CVE-2025-66614. The vulnerability (missing SNI-to-Host header validation that allowed client certificate authentication bypass) was fixed by Apache upstream in commit 972f9a5e2a, which shipped as part of the Apache Tomcat 10.1.50 release. The fix is present in the target at the analyzed SHA (00fc3ab247). The CVE documentation correctly identifies 10.1.50 as the first fixed version in the 10.1.x branch. TuxCare onboarded the already-fixed upstream release without needing a separate backport for this CVE on the 10.1.50 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "impact_statement": "Target version 10.1.50 is NOT AFFECTED by CVE-2025-66614. The vulnerability (missing SNI-to-Host header validation that allowed client certificate authentication bypass) was fixed by Apache upstream in commit 972f9a5e2a, which shipped as part of the Apache Tomcat 10.1.50 release. The fix is present in the target at the analyzed SHA (00fc3ab247). The CVE documentation correctly identifies 10.1.50 as the first fixed version in the 10.1.x branch. TuxCare onboarded the already-fixed upstream release without needing a separate backport for this CVE on the 10.1.50 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:56.598523+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:31:30.745035+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.50 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added with a code defect (using HashSet instead of LinkedHashSet), causing configured cipher preference order to be lost. Version 10.1.50 predates this feature and uses a simpler, correct implementation that properly preserves cipher order via Linke...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.50 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added with a code defect (using HashSet instead of LinkedHashSet), causing configured cipher preference order to be lost. Version 10.1.50 predates this feature and uses a simpler, correct implementation that properly preserves cipher order via Linke..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:42.813849+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:42.813849+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:22:13.163647+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.50-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.50-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:42.813849+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T13:33:00.186713+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.50-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.50-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T14:22:33.932118+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.50-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 10.1.50-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}