{
  "@id": "urn:uuid:ffb1dad3-d29a-4e82-8388-57a0b34c0bba",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T16:52:53.138657+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager application affecting versions 5.5.9-5.5.26 and 6.0.0-6.0.16. The vulnerability allowed remote attackers to inject arbitrary web script via the name parameter to host-manager/html/add. The target version (10.1.55) is not affected because the fix was already present in the upstream Tomcat 10.1.55 release when TuxCare onboarded...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager application affecting versions 5.5.9-5.5.26 and 6.0.0-6.0.16. The vulnerability allowed remote attackers to inject arbitrary web script via the name parameter to host-manager/html/add. The target version (10.1.55) is not affected because the fix was already present in the upstream Tomcat 10.1.55 release when TuxCare onboarded..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing thread consumption via Content-Length: 0 AJP requests. The upstream fix (commit 8884dae60ac by Mark Thomas, 2014-03-17) added explicit handling for zero-length requests by setting endOfStream=true and returning early, preventing the thread hang. This fix was already present in Tomcat 10.1.55 when TuxCare onboarded it (commit df13cfd2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing thread consumption via Content-Length: 0 AJP requests. The upstream fix (commit 8884dae60ac by Mark Thomas, 2014-03-17) added explicit handling for zero-length requests by setting endOfStream=true and returning early, preventing the thread hang. This fix was already present in Tomcat 10.1.55 when TuxCare onboarded it (commit df13cfd2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.55 is not affected by CVE-2017-12615. The vulnerability targets the FileDirContext class in Tomcat 7.0.0-7.0.79, which allowed bypassing path validation when creating files via operations like bind/rebind/rename. Tomcat 10 uses a completely different architecture (WebResourceRoot) introduced in Tomcat 8 (2012) that replaced the JNDI-based FileDirContext system. The WebResource architecture includes comprehensive path validation in AbstractFileResourceSet.file() that prevents the exploit: it rejects Windows filenames ending with spaces via isInvalidWindowsFilename() and detects Windows stripping trailing characters via canonical path comparison. The vulnerable code path does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Tomcat 10.1.55 is not affected by CVE-2017-12615. The vulnerability targets the FileDirContext class in Tomcat 7.0.0-7.0.79, which allowed bypassing path validation when creating files via operations like bind/rebind/rename. Tomcat 10 uses a completely different architecture (WebResourceRoot) introduced in Tomcat 8 (2012) that replaced the JNDI-based FileDirContext system. The WebResource architecture includes comprehensive path validation in AbstractFileResourceSet.file() that prevents the exploit: it rejects Windows filenames ending with spaces via isInvalidWindowsFilename() and detects Windows stripping trailing characters via canonical path comparison. The vulnerable code path does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is not present in Tomcat 10.1.55. The vulnerability affects Tomcat 7.0.0-7.0.81, 8.0.0.RC1-8.0.46, 8.5.0-8.5.22, and 9.0.0.M1-9.0.0. The fix was already included in the upstream Apache Tomcat release that TuxCare onboarded. The vulnerable pattern (missing validation of trailing slashes in file paths during HTTP PUT operations) has been mitigated by upstream patches authored by Mark Thomas in September 2017 that validate paths before file creation operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is not present in Tomcat 10.1.55. The vulnerability affects Tomcat 7.0.0-7.0.81, 8.0.0.RC1-8.0.46, 8.5.0-8.5.22, and 9.0.0.M1-9.0.0. The fix was already included in the upstream Apache Tomcat release that TuxCare onboarded. The vulnerable pattern (missing validation of trailing slashes in file paths during HTTP PUT operations) has been mitigated by upstream patches authored by Mark Thomas in September 2017 that validate paths before file creation operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 affects Apache Tomcat versions 7.0.0-7.0.75, 8.0.0.RC1-8.0.41, 8.5.0-8.5.11, and 9.0.0.M1-9.0.0.M17. The vulnerability was fixed upstream in March 2017 (commit dfa40863 by Mark Thomas) and included in all subsequent releases. The target version 10.1.55 already contains the fix in its upstream release: all calls to fireRequestInitEvent() and fireRequestDestroyEvent() use the facade pattern (request.getRequest()) rather than passing internal request objects directly to application listeners. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 affects Apache Tomcat versions 7.0.0-7.0.75, 8.0.0.RC1-8.0.41, 8.5.0-8.5.11, and 9.0.0.M1-9.0.0.M17. The vulnerability was fixed upstream in March 2017 (commit dfa40863 by Mark Thomas) and included in all subsequent releases. The target version 10.1.55 already contains the fix in its upstream release: all calls to fireRequestInitEvent() and fireRequestDestroyEvent() use the facade pattern (request.getRequest()) rather than passing internal request objects directly to application listeners. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 is NOT present in Apache Tomcat 10.1.55. The vulnerability (sendfile state tracking race condition causing processor double-caching and response mix-up) was fixed in the upstream release. Fix commit 9233d9d6a0 by markt@apache.org is present in HEAD and predates TuxCare's onboarding commit df13cfd2cc. All defense mechanisms from the vendor patch are verified in the target code: SendfileState variable tracks completion independently of sendfileData pointer, preventing incorrect SocketState return when sendfile completes quickly and processor is recycled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 is NOT present in Apache Tomcat 10.1.55. The vulnerability (sendfile state tracking race condition causing processor double-caching and response mix-up) was fixed in the upstream release. Fix commit 9233d9d6a0 by markt@apache.org is present in HEAD and predates TuxCare's onboarding commit df13cfd2cc. All defense mechanisms from the vendor patch are verified in the target code: SendfileState variable tracks completion independently of sendfileData pointer, preventing incorrect SocketState return when sendfile completes quickly and processor is recycled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is not present in Apache Tomcat 10.1.55. The vulnerability involved directory redirects in DefaultServlet that could generate protocol-relative URLs (e.g., //evil.com/path) via specially crafted request URIs, allowing redirects to attacker-controlled locations. The upstream fix (commit efb860b3ff by Mark Thomas, 2018-09-04) strips consecutive leading slashes from redirect locatio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 is not present in Apache Tomcat 10.1.55. The vulnerability involved directory redirects in DefaultServlet that could generate protocol-relative URLs (e.g., //evil.com/path) via specially crafted request URIs, allowing redirects to attacker-controlled locations. The upstream fix (commit efb860b3ff by Mark Thomas, 2018-09-04) strips consecutive leading slashes from redirect locatio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2018-1304. The vulnerability, which allowed security constraints with an empty string URL pattern (\"\") to be ignored, was fixed in the upstream Apache Tomcat project in February 2018 (commit 723ea6a5bc by Mark Thomas). This fix was already present in the Apache Tomcat 10.1.55 release that TuxCare onboarded, as confirmed by examining the code at the o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2018-1304. The vulnerability, which allowed security constraints with an empty string URL pattern (\"\") to be ignored, was fixed in the upstream Apache Tomcat project in February 2018 (commit 723ea6a5bc by Mark Thomas). This fix was already present in the Apache Tomcat 10.1.55 release that TuxCare onboarded, as confirmed by examining the code at the o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 concerns security constraints defined by ServletSecurity annotations being applied only after servlet load time, potentially allowing unauthorized access depending on servlet loading order. The vulnerability was fixed in Apache Tomcat by upstream commit 3e54b2a631 (Feb 2018) which moved ServletSecurity annotation processing to application start time. This upstream fix was already ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 concerns security constraints defined by ServletSecurity annotations being applied only after servlet load time, potentially allowing unauthorized access depending on servlet loading order. The vulnerability was fixed in Apache Tomcat by upstream commit 3e54b2a631 (Feb 2018) which moved ServletSecurity annotation processing to application start time. This upstream fix was already ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 describes an infinite loop vulnerability in Tomcat's custom Utf8Decoder.java when handling UTF-8 supplementary characters with output buffer overflow. The target (Tomcat 10.1.55) is NOT affected because the vulnerable custom Utf8Decoder.java component was completely removed by upstream Apache in April 2022 (commit a9ca10266b, authored by markt@apache.org), prior to TuxCare's onboarding of version 10.1.55. The target uses Java's standard CharsetDecoder instead, which does not have this vulnerability (the bug was fixed in Java 8+, and Tomcat 10 requires Java 11+). This is an upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 describes an infinite loop vulnerability in Tomcat's custom Utf8Decoder.java when handling UTF-8 supplementary characters with output buffer overflow. The target (Tomcat 10.1.55) is NOT affected because the vulnerable custom Utf8Decoder.java component was completely removed by upstream Apache in April 2022 (commit a9ca10266b, authored by markt@apache.org), prior to TuxCare's onboarding of version 10.1.55. The target uses Java's standard CharsetDecoder instead, which does not have this vulnerability (the bug was fixed in Java 8+, and Tomcat 10 requires Java 11+). This is an upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 is NOT present in Apache Tomcat 10.1.55. The vulnerability concerned insecure CORS filter defaults (allowedOrigins=\"*\" + supportsCredentials=\"true\") that enabled credential theft. The upstream fix from May 2018 by Mark Thomas (markt@apache.org) changed defaults to secure values (allowedOrigins=\"\" and supportsCredentials=\"false\") and added runtime validation preventing the dangerous combination. This fix was already present in Tomcat 10.1.55 upstream release before TuxCare onboarded it (commit df13cfd2cc by amoniatovskiy@cloudlinux.com). All three fix components are verified present in HEAD at commit c5b492c1bf.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 is NOT present in Apache Tomcat 10.1.55. The vulnerability concerned insecure CORS filter defaults (allowedOrigins=\"*\" + supportsCredentials=\"true\") that enabled credential theft. The upstream fix from May 2018 by Mark Thomas (markt@apache.org) changed defaults to secure values (allowedOrigins=\"\" and supportsCredentials=\"false\") and added runtime validation preventing the dangerous combination. This fix was already present in Tomcat 10.1.55 upstream release before TuxCare onboarded it (commit df13cfd2cc by amoniatovskiy@cloudlinux.com). All three fix components are verified present in HEAD at commit c5b492c1bf.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 affects missing hostname verification in WebSocket TLS client connections. Apache Tomcat 10.1.55 is not affected because the upstream fix (enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\")) was already present in the upstream release that TuxCare onboarded. The fix was committed upstream by Mark Thomas (markt@apache.org) in June 2018, approximately 8 years before Tomcat 10.1.55 was released and onboarded by TuxCare in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 affects missing hostname verification in WebSocket TLS client connections. Apache Tomcat 10.1.55 is not affected because the upstream fix (enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\")) was already present in the upstream release that TuxCare onboarded. The fix was committed upstream by Mark Thomas (markt@apache.org) in June 2018, approximately 8 years before Tomcat 10.1.55 was released and onboarded by TuxCare in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2018-8037. The vulnerability (async timeout race condition causing response cross-contamination) was fixed in upstream Apache Tomcat and the fix was already present in the 10.1.55 release when TuxCare onboarded it. The generation tracking mechanism that prevents the race condition exists in the target code at java/org/apache/coyote/AsyncStateMachine....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2018-8037. The vulnerability (async timeout race condition causing response cross-contamination) was fixed in upstream Apache Tomcat and the fix was already present in the 10.1.55 release when TuxCare onboarded it. The generation tracking mechanism that prevents the race condition exists in the target code at java/org/apache/coyote/AsyncStateMachine...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199: Target Tomcat 10.1.55 is NOT AFFECTED. The vulnerability involves HTTP/2 DoS via excessive control frames and indefinite thread blocking when clients keep streams open without reading/writing data. The upstream Tomcat 10.1.55 release includes comprehensive fixes: (1) stream-level read/write timeouts (20s defaults) that unblock threads waiting for client data or flow control window increases, and (2) overhead frame counting that tracks control frames (SETTINGS, PING, PRIORITY, RST) vs data frames and closes connections with ENHANCE_YOUR_CALM when overhead exceeds threshold. These defenses were added by Apache committer Mark Thomas in commit c38033338a (\"Add stream timeouts\") and related overhead protection commits, all shipped in the upstream release before TuxCare onboarded version 10.1.55. The vulnerable pattern (indefinite thread blocking leading to exhaustion) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199: Target Tomcat 10.1.55 is NOT AFFECTED. The vulnerability involves HTTP/2 DoS via excessive control frames and indefinite thread blocking when clients keep streams open without reading/writing data. The upstream Tomcat 10.1.55 release includes comprehensive fixes: (1) stream-level read/write timeouts (20s defaults) that unblock threads waiting for client data or flow control window increases, and (2) overhead frame counting that tracks control frames (SETTINGS, PING, PRIORITY, RST) vs data frames and closes connections with ENHANCE_YOUR_CALM when overhead exceeds threshold. These defenses were added by Apache committer Mark Thomas in commit c38033338a (\"Add stream timeouts\") and related overhead protection commits, all shipped in the upstream release before TuxCare onboarded version 10.1.55. The vulnerable pattern (indefinite thread blocking leading to exhaustion) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes environment variables without escaping, enabling XSS. The target (Apache Tomcat 10.1.55) is NOT AFFECTED because the upstream fix (commit 15fcd166ea by Mark Thomas) is already present, having shipped in the upstream 10.1.55 release that TuxCare onboarded. The fix adds HTML entity encoding via SSIMediator.ENCODING_ENTITY parameter to es...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes environment variables without escaping, enabling XSS. The target (Apache Tomcat 10.1.55) is NOT AFFECTED because the upstream fix (commit 15fcd166ea by Mark Thomas) is already present, having shipped in the upstream 10.1.55 release that TuxCare onboarded. The fix adds HTML entity encoding via SSIMediator.ENCODING_ENTITY parameter to es..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 affects CGI Servlet on Windows when enableCmdLineArguments is enabled, allowing RCE through command line injection. The upstream Apache Tomcat fix (commit 4b244d827a by Mark Thomas) was already present in version 10.1.55 when TuxCare onboarded it. The fix validates decoded command line arguments against a safe character pattern (alphanumeric plus limited punctuation) before OS execution, rejecting requests with unsafe characters. The vulnerable pattern (unvalidated decoded arguments reaching OS command execution) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 affects CGI Servlet on Windows when enableCmdLineArguments is enabled, allowing RCE through command line injection. The upstream Apache Tomcat fix (commit 4b244d827a by Mark Thomas) was already present in version 10.1.55 when TuxCare onboarded it. The fix validates decoded command line arguments against a safe character pattern (alphanumeric plus limited punctuation) before OS execution, rejecting requests with unsafe characters. The vulnerable pattern (unvalidated decoded arguments reaching OS command execution) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 is NOT present in Apache Tomcat 10.1.55. The vulnerability affecting HTTP/2 connection window exhaustion was fixed by upstream Apache in commit 7f748eb6bf (April 2019) and was already present in the Tomcat 10.1.55 release that TuxCare onboarded. The fix adds timeout handling to connection-level flow control window waits, preventing indefinite thread blocking when malicious clients withhold WINDOW_UPDATE messages for stream 0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "CVE-2019-10072 is NOT present in Apache Tomcat 10.1.55. The vulnerability affecting HTTP/2 connection window exhaustion was fixed by upstream Apache in commit 7f748eb6bf (April 2019) and was already present in the Tomcat 10.1.55 release that TuxCare onboarded. The fix adds timeout handling to connection-level flow control window waits, preventing indefinite thread blocking when malicious clients withhold WINDOW_UPDATE messages for stream 0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 affects Apache Tomcat's JMX Remote Lifecycle Listener component, which allowed local attackers to manipulate the RMI registry and capture JMX credentials. This component (JmxRemoteLifecycleListener) was deprecated and completely removed from Tomcat before version 10.0.0 was released in December 2020. The removal occurred in commit 46fbf32e55 on January 15, 2020. Tomcat 10.1.55 never included this component. No alternative implementation of the vulnerable RMI registry creation pattern exists in the current codebase. The functionality was deprecated in favor of standard JVM remote JMX capabilities, which use a different architecture not affected by this CVE. Rule 5 Type A1 applies: the Input type (RMI registry mutation calls) is not received anywhere in the target because the component that would create and expose the registry does not exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 affects Apache Tomcat's JMX Remote Lifecycle Listener component, which allowed local attackers to manipulate the RMI registry and capture JMX credentials. This component (JmxRemoteLifecycleListener) was deprecated and completely removed from Tomcat before version 10.0.0 was released in December 2020. The removal occurred in commit 46fbf32e55 on January 15, 2020. Tomcat 10.1.55 never included this component. No alternative implementation of the vulnerable RMI registry creation pattern exists in the current codebase. The functionality was deprecated in favor of standard JVM remote JMX capabilities, which use a different architecture not affected by this CVE. Rule 5 Type A1 applies: the Input type (RMI registry mutation calls) is not received anywhere in the target because the component that would create and expose the registry does not exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 affects Tomcat versions 7.0.0-7.0.98, 8.5.0-8.5.49, and 9.0.0.M1-9.0.29, addressing a session fixation vulnerability in FORM authentication when Principal caching is disabled (cache=false). The target is Tomcat 10.1.55, which already contains the upstream fix (commit 1ecba14e69 by Mark Thomas, December 2019) that shipped with the Apache Tomcat 10.1.55 release. The vulnerable code pattern is not present; the fix was incorporated before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 affects Tomcat versions 7.0.0-7.0.98, 8.5.0-8.5.49, and 9.0.0.M1-9.0.29, addressing a session fixation vulnerability in FORM authentication when Principal caching is disabled (cache=false). The target is Tomcat 10.1.55, which already contains the upstream fix (commit 1ecba14e69 by Mark Thomas, December 2019) that shipped with the Apache Tomcat 10.1.55 release. The vulnerable code pattern is not present; the fix was incorporated before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The fix was applied by upstream Apache Tomcat on December 17, 2019 (commit 3c295d913e) and was already present in the upstream Tomcat 10.1.55 re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The fix was applied by upstream Apache Tomcat on December 17, 2019 (commit 3c295d913e) and was already present in the upstream Tomcat 10.1.55 re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-11996 is not present in Tomcat 10.1.55. The vulnerable code pattern (the closeIdleStreams method with a loop iterating over a potentially huge range of stream IDs) was completely removed in upstream commit 043d6581b8 which shipped in the upstream 10.1.55 release before TuxCare onboarded it. The current code uses pruneClosedStreams() which safely iterates only over actual existing streams, preventing the CPU exhaustion DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 is not present in Tomcat 10.1.55. The vulnerable code pattern (the closeIdleStreams method with a loop iterating over a potentially huge range of stream IDs) was completely removed in upstream commit 043d6581b8 which shipped in the upstream 10.1.55 release before TuxCare onboarded it. The current code uses pruneClosedStreams() which safely iterates only over actual existing streams, preventing the CPU exhaustion DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 10.1.55 is not affected by CVE-2020-1935. The vulnerability targeted Tomcat 7.x, 8.5.x, and 9.x (up to versions released in late 2019/early 2020). Tomcat 10.x was released in December 2020, after the CVE was fixed, and incorporated the defenses from the start. The target code in Http11InputBuffer.java (lines 973, 976) properly rejects the two key attack vectors: (1) control characters in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Tomcat 10.1.55 is not affected by CVE-2020-1935. The vulnerability targeted Tomcat 7.x, 8.5.x, and 9.x (up to versions released in late 2019/early 2020). Tomcat 10.x was released in December 2020, after the CVE was fixed, and incorporated the defenses from the start. The target code in Http11InputBuffer.java (lines 973, 976) properly rejects the two key attack vectors: (1) control characters in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Tomcat 10.1.55. All three defensive layers from the upstream fix are present: (1) AJP connector is disabled by default in server.xml (lines 105-112), (2) when enabled, it binds to loopback address by default (AbstractAjpProtocol.java:56-57), (3) secret validation with secretRequired=true by default (AbstractAjpProtocol.java:167-228, AjpProcessor.java:836-859), and (4) request attribute pattern validation (AbstractAjpProtocol.java:231-258, AjpProcessor.java:759-766). These fixes were authored by Mark Thomas (markt@apache.org) on 2020-01-21 and shipped in the upstream Tomcat 10.1.55 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Tomcat 10.1.55. All three defensive layers from the upstream fix are present: (1) AJP connector is disabled by default in server.xml (lines 105-112), (2) when enabled, it binds to loopback address by default (AbstractAjpProtocol.java:56-57), (3) secret validation with secretRequired=true by default (AbstractAjpProtocol.java:167-228, AjpProcessor.java:836-859), and (4) request attribute pattern validation (AbstractAjpProtocol.java:231-258, AjpProcessor.java:759-766). These fixes were authored by Mark Thomas (markt@apache.org) on 2020-01-21 and shipped in the upstream Tomcat 10.1.55 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-9484 is a path traversal vulnerability in Tomcat's FileStore that allows attackers to trigger deserialization of arbitrary files when conditions a-d are met (attacker controls file content/name, FileStore is enabled, lax filter, known file path). Apache Tomcat 10.1.55 is NOT AFFECTED because the fix (commit 6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4) was already included in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The fix validates that file paths constructed from session IDs remain within the storage directory boundary using Path.startsWith() canonicalization checks, preventing path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 is a path traversal vulnerability in Tomcat's FileStore that allows attackers to trigger deserialization of arbitrary files when conditions a-d are met (attacker controls file content/name, FileStore is enabled, lax filter, known file path). Apache Tomcat 10.1.55 is NOT AFFECTED because the fix (commit 6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4) was already included in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The fix validates that file paths constructed from session IDs remain within the storage directory boundary using Path.startsWith() canonicalization checks, preventing path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2021-24122. The upstream fix (commit 7f004ac453) that adds ':' to invalid Windows filename characters was already present in the upstream 10.1.55 release before TuxCare onboarded it. This fix prevents File.getCanonicalPath() bypass that could lead to JSP source code disclosure.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2021-24122. The upstream fix (commit 7f004ac453) that adds ':' to invalid Windows filename characters was already present in the upstream 10.1.55 release before TuxCare onboarded it. This fix prevents File.getCanonicalPath() bypass that could lead to JSP source code disclosure."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 is not present in Apache Tomcat 10.1.55. The vulnerability involved a shared StringBuilder instance field in HpackDecoder that could be accessed concurrently by multiple h2c requests, causing request data from one user to leak into another user's request. The fix (commit 8d2fe6894d by Mark Thomas) replaced the shared instance field with request-local StringBuilder variables, eliminating the cross-request contamination. This fix was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it (first TuxCare commit: df13cfd2cc). The target repository contains the fixed code with no shared StringBuilder fields.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 is not present in Apache Tomcat 10.1.55. The vulnerability involved a shared StringBuilder instance field in HpackDecoder that could be accessed concurrently by multiple h2c requests, causing request data from one user to leak into another user's request. The fix (commit 8d2fe6894d by Mark Thomas) replaced the shared instance field with request-local StringBuilder variables, eliminating the cross-request contamination. This fix was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it (first TuxCare commit: df13cfd2cc). The target repository contains the fixed code with no shared StringBuilder fields.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.55 is NOT AFFECTED by CVE-2021-25329. The vulnerability involves incomplete path validation that could allow directory traversal attacks. All affected files (FileStore.java, ExpandWar.java, DefaultServlet.java, HostConfig.java, ContextConfig.java) already contain the upstream fix using NIO Path-based checking (`getCanonicalFile().toPath().startsWith()`) instead of vulnerable string-based checking. The fixes were authored by Mark Thomas (Apache upstream) in commits 6d66e99ef85 (2021-01-20) and 70da1aaa51e (2022-01-12), both ancestors of TuxCare's onboarding commit df13cfd2cc (2026-09-22). The vulnerable pattern was never present in this version as shipped.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "Target Tomcat 10.1.55 is NOT AFFECTED by CVE-2021-25329. The vulnerability involves incomplete path validation that could allow directory traversal attacks. All affected files (FileStore.java, ExpandWar.java, DefaultServlet.java, HostConfig.java, ContextConfig.java) already contain the upstream fix using NIO Path-based checking (`getCanonicalFile().toPath().startsWith()`) instead of vulnerable string-based checking. The fixes were authored by Mark Thomas (Apache upstream) in commits 6d66e99ef85 (2021-01-20) and 70da1aaa51e (2022-01-12), both ancestors of TuxCare's onboarding commit df13cfd2cc (2026-09-22). The vulnerable pattern was never present in this version as shipped.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 is not present in Apache Tomcat 10.1.55. The vulnerability affects versions 8.5.0-8.5.82, 9.0.0-M1-9.0.67, 10.0.0-M1-10.0.26, and 10.1.0-M1-10.1.0. The target version 10.1.55 is beyond this range and contains the upstream fix (commit c9fe754e5d) that forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting. The fix was authored by Mark Thomas (markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "CVE-2022-42252 is not present in Apache Tomcat 10.1.55. The vulnerability affects versions 8.5.0-8.5.82, 9.0.0-M1-9.0.67, 10.0.0-M1-10.0.26, and 10.1.0-M1-10.1.0. The target version 10.1.55 is beyond this range and contains the upstream fix (commit c9fe754e5d) that forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting. The fix was authored by Mark Thomas (markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.55 is NOT affected by CVE-2022-45143. The vulnerability concerns missing JSON escaping in JsonErrorReportValve's type, message, and description fields, allowing JSON injection attacks. The fix (commit 1f50bff8da by Mark Thomas, dated 2022-11-09) that adds JSONFilter.escape() calls was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded this version. The CVE affects versions 10.1.0-M1 to 10.1.1; version 10.1.55 is significantly later and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Target version 10.1.55 is NOT affected by CVE-2022-45143. The vulnerability concerns missing JSON escaping in JsonErrorReportValve's type, message, and description fields, allowing JSON injection attacks. The fix (commit 1f50bff8da by Mark Thomas, dated 2022-11-09) that adds JSONFilter.escape() calls was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded this version. The CVE affects versions 10.1.0-M1 to 10.1.1; version 10.1.55 is significantly later and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 (DoS via unbounded multipart request parts) is NOT present in Tomcat 10.1.55. The upstream Apache Tomcat fix was already included in the 10.1.55 release that TuxCare onboarded. The fix adds FileUploadBase.setFileCountMax() and checks items.size() == fileCountMax before processing each part, throwing FileCountLimitExceededException when the limit is exceeded. Request.parseParts() applies this limit by computing partLimit from maxParameterCount and maxPartCount. All fix components (FileUploadBase defense check, Request integration, Parameters.size() method, FileCountLimitExceededException class) are present in the target at the authoritative SHA c5b492c1bfe321aa1526c142774a77d53804c197.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 (DoS via unbounded multipart request parts) is NOT present in Tomcat 10.1.55. The upstream Apache Tomcat fix was already included in the 10.1.55 release that TuxCare onboarded. The fix adds FileUploadBase.setFileCountMax() and checks items.size() == fileCountMax before processing each part, throwing FileCountLimitExceededException when the limit is exceeded. Request.parseParts() applies this limit by computing partLimit from maxParameterCount and maxPartCount. All fix components (FileUploadBase defense check, Request integration, Parameters.size() method, FileCountLimitExceededException class) are present in the target at the authoritative SHA c5b492c1bfe321aa1526c142774a77d53804c197.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 10.1.55 is NOT AFFECTED by CVE-2023-28709. The vulnerability (an off-by-one error in parameter counting that could allow bypassing maxParameterCount limits) was fixed in upstream Tomcat 10.1.8 by commit ba848da71c on April 11, 2023. The fix was already present in the upstream 10.1.55 release when TuxCare onboarded it (commit df13cfd2cc). The target's Parameters.java::addParameter() method (lines 198-213) shows the corrected logic: the limit check happens BEFORE incrementing the counter (line 204) using >= comparison, and the increment happens AFTER the check (line 210), preventing the boundary condition bypass described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "The target Tomcat 10.1.55 is NOT AFFECTED by CVE-2023-28709. The vulnerability (an off-by-one error in parameter counting that could allow bypassing maxParameterCount limits) was fixed in upstream Tomcat 10.1.8 by commit ba848da71c on April 11, 2023. The fix was already present in the upstream 10.1.55 release when TuxCare onboarded it (commit df13cfd2cc). The target's Parameters.java::addParameter() method (lines 198-213) shows the corrected logic: the limit check happens BEFORE incrementing the counter (line 204) using >= comparison, and the increment happens AFTER the check (line 210), preventing the boundary condition bypass described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-34981 affects Apache Tomcat versions 11.0.0-M5, 10.1.8, 9.0.74, and 8.5.88 due to a regression in the fix for bug 66512. The target version 10.1.55 is NOT affected. The vulnerability was fixed in the upstream Apache Tomcat release by commit f0742f47b9 (authored by markt@apache.org on 2023-05-03), which was already present when TuxCare onboarded version 10.1.55. The fix ensures that an AJP SEND_HEADERS message is always sent for every response, even when the response contains no HTTP headers, preventing mod_proxy_ajp from reusing headers from previous requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "CVE-2023-34981 affects Apache Tomcat versions 11.0.0-M5, 10.1.8, 9.0.74, and 8.5.88 due to a regression in the fix for bug 66512. The target version 10.1.55 is NOT affected. The vulnerability was fixed in the upstream Apache Tomcat release by commit f0742f47b9 (authored by markt@apache.org on 2023-05-03), which was already present when TuxCare onboarded version 10.1.55. The fix ensures that an AJP SEND_HEADERS message is always sent for every response, even when the response contains no HTTP headers, preventing mod_proxy_ajp from reusing headers from previous requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix by Mark Thomas (markt@apache.org) in commit 76bb4bfbfeae827dce896f650655bbf6e251ed49 shipped with the Apache Tomcat 10.1.55 release that TuxCare onboarded. The defense is complete and enabled by default: RST frames increment an overhead counter by factor 50, and connections are closed when the threshold is exceeded. No TuxCare backport was required - the vulnerability pattern is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix by Mark Thomas (markt@apache.org) in commit 76bb4bfbfeae827dce896f650655bbf6e251ed49 shipped with the Apache Tomcat 10.1.55 release that TuxCare onboarded. The defense is complete and enabled by default: RST frames increment an overhead counter by factor 50, and connections are closed when the threshold is exceeded. No TuxCare backport was required - the vulnerability pattern is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.55 is not affected by CVE-2023-46589. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed upstream by Apache in October-November 2023 and shipped in Apache Tomcat 10.1.16+. The target version 10.1.55 was onboarded by TuxCare from the upstream release, which already contained the fix in refactored form: (1) HttpHeaderParser validates trailer header names using HttpParser.isToken() and values using HttpParser.isControl() checks, rejecting malformed headers; (2) InputBuffer.handleReadException() ensures IOExceptions during request reading set error flags to prevent request boundary confusion. Original CVE fix commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 (2023-10-05) by markt@apache.org was later refactored into HttpHeaderParser (a5a7c112505b471e943967fd33c72299cbe6bb9f, 2024-04-26), both predating the first TuxCare onboarding commit df13cfd2cca80866443a0ebeb3873a17370617a9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "Target Apache Tomcat 10.1.55 is not affected by CVE-2023-46589. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed upstream by Apache in October-November 2023 and shipped in Apache Tomcat 10.1.16+. The target version 10.1.55 was onboarded by TuxCare from the upstream release, which already contained the fix in refactored form: (1) HttpHeaderParser validates trailer header names using HttpParser.isToken() and values using HttpParser.isControl() checks, rejecting malformed headers; (2) InputBuffer.handleReadException() ensures IOExceptions during request reading set error flags to prevent request boundary confusion. Original CVE fix commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 (2023-10-05) by markt@apache.org was later refactored into HttpHeaderParser (a5a7c112505b471e943967fd33c72299cbe6bb9f, 2024-04-26), both predating the first TuxCare onboarding commit df13cfd2cca80866443a0ebeb3873a17370617a9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Tomcat 10.1.55 is NOT AFFECTED by CVE-2024-21733. The fix for this vulnerability (checking IS_IO_ALLOWED before error I/O operations to prevent sensitive information disclosure) was already present in upstream Apache Tomcat 10.1.55 when it was released (2026-05-05). The fixing commit ce4f9a5e by markt@apache.org from 2021-02-24 was included in the upstream release that TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 10.1.55 is NOT AFFECTED by CVE-2024-21733. The fix for this vulnerability (checking IS_IO_ALLOWED before error I/O operations to prevent sensitive information disclosure) was already present in upstream Apache Tomcat 10.1.55 when it was released (2026-05-05). The fixing commit ce4f9a5e by markt@apache.org from 2021-02-24 was included in the upstream release that TuxCare onboarded ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-34750 affects Apache Tomcat 10.1.0-M1 through 10.1.24 and is fixed in 10.1.25. The target is version 10.1.55, which already contains the upstream fix. The vulnerability involved miscounting of active HTTP/2 streams due to potential double-decrement operations during exceptional conditions, leading to incorrect infinite timeouts. The fix adds an atomic compareAndSet flag per stream to ensure idempotent decrement. This fix is present in the target at Stream.java:98,999-1010, introduced by upstream Apache commit 2afae300c9 (author: markt@apache.org) which shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "impact_statement": "CVE-2024-34750 affects Apache Tomcat 10.1.0-M1 through 10.1.24 and is fixed in 10.1.25. The target is version 10.1.55, which already contains the upstream fix. The vulnerability involved miscounting of active HTTP/2 streams due to potential double-decrement operations during exceptional conditions, leading to incorrect infinite timeouts. The fix adds an atomic compareAndSet flag per stream to ensure idempotent decrement. This fix is present in the target at Stream.java:98,999-1010, introduced by upstream Apache commit 2afae300c9 (author: markt@apache.org) which shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.55 is not affected by CVE-2024-38286. The vulnerability (unbounded accumulation of TLS handshake wrap requests leading to OutOfMemoryError) is not present because the upstream Apache Tomcat project already included the fix in version 10.1.55. Both TLS channel implementations (SecureNio2Channel and SecureNioChannel) contain complete defenses: SecureNio2Channel limits handshake wrap queue length to 100 via HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT constant with checks at lines 810-813, 1016-1020, and 1131-1135; SecureNioChannel uses needHandshakeWrap boolean flag with pending checks at lines 660 and 756. The fix commit (3344c17cef by Mark Thomas) was already in the upstream 10.1.55 release when TuxCare onboarded it via commit b0c0568037.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "impact_statement": "Target Apache Tomcat 10.1.55 is not affected by CVE-2024-38286. The vulnerability (unbounded accumulation of TLS handshake wrap requests leading to OutOfMemoryError) is not present because the upstream Apache Tomcat project already included the fix in version 10.1.55. Both TLS channel implementations (SecureNio2Channel and SecureNioChannel) contain complete defenses: SecureNio2Channel limits handshake wrap queue length to 100 via HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT constant with checks at lines 810-813, 1016-1020, and 1131-1135; SecureNioChannel uses needHandshakeWrap boolean flag with pending checks at lines 660 and 756. The fix commit (3344c17cef by Mark Thomas) was already in the upstream 10.1.55 release when TuxCare onboarded it via commit b0c0568037.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 already contains the complete upstream fix for CVE-2024-50379 (TOCTOU race condition in JSP compilation). The fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream 10.1.55 release. The target repository shows WebResourceLockSet interface, DirResourceSet locking implementation, and FileResource delete() protection all present at HEAD (3ebb4d5aea), which is the onboarding of upstream 10.1.55. The vulnerable pattern (unsynchronized file metadata access during concurrent reads/writes) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "impact_statement": "Apache Tomcat 10.1.55 already contains the complete upstream fix for CVE-2024-50379 (TOCTOU race condition in JSP compilation). The fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream 10.1.55 release. The target repository shows WebResourceLockSet interface, DirResourceSet locking implementation, and FileResource delete() protection all present at HEAD (3ebb4d5aea), which is the onboarding of upstream 10.1.55. The vulnerable pattern (unsynchronized file metadata access during concurrent reads/writes) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is not affected by CVE-2024-52317. The vulnerability involves incorrect recycling of HTTP/2 request/response objects that could lead to request/response data mix-up between users. The fix, which adds double-checked locking to prevent duplicate recycling calls, was already present in the upstream Apache Tomcat 10.1.55 release when TuxCare onboarded i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is not affected by CVE-2024-52317. The vulnerability involves incorrect recycling of HTTP/2 request/response objects that could lead to request/response data mix-up between users. The fix, which adds double-checked locking to prevent duplicate recycling calls, was already present in the upstream Apache Tomcat 10.1.55 release when TuxCare onboarded i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.55 is not vulnerable to CVE-2024-56337. The upstream Apache Tomcat 10.1.55 release already included the complete CVE-2024-56337 mitigation before TuxCare onboarded it. The fix includes: (1) JVM flag -Dsun.io.useCanonCaches=false set in startup scripts, (2) runtime validation in DirResourceSet.initInternal() that verifies the protection and throws exceptions if it cannot be enabled, (3) path normalization that always converts lock keys to lowercase, and (4) read/write locking from CVE-2024-50379. Fix authored by Mark Thomas (markt@apache.org) from Apache, shipped in upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "impact_statement": "Target Apache Tomcat 10.1.55 is not vulnerable to CVE-2024-56337. The upstream Apache Tomcat 10.1.55 release already included the complete CVE-2024-56337 mitigation before TuxCare onboarded it. The fix includes: (1) JVM flag -Dsun.io.useCanonCaches=false set in startup scripts, (2) runtime validation in DirResourceSet.initInternal() that verifies the protection and throws exceptions if it cannot be enabled, (3) path normalization that always converts lock keys to lowercase, and (4) read/write locking from CVE-2024-50379. Fix authored by Mark Thomas (markt@apache.org) from Apache, shipped in upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Tomcat 10.1.55) is NOT AFFECTED by CVE-2025-24813. The vulnerability pattern (predictable temp file naming via path.replace('/', '.')) does not exist in the target code. The fix was already present in upstream Apache Tomcat 10.1.55 before TuxCare onboarded it. The target uses File.createTempFile() which generates cryptographically random temp file names, eliminating the path equivalence vulnerability. Fix commit f6c01d6577 by remm@apache.org was already in the upstream release when TuxCare imported version 10.1.55.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "impact_statement": "The target repository (Tomcat 10.1.55) is NOT AFFECTED by CVE-2025-24813. The vulnerability pattern (predictable temp file naming via path.replace('/', '.')) does not exist in the target code. The fix was already present in upstream Apache Tomcat 10.1.55 before TuxCare onboarded it. The target uses File.createTempFile() which generates cryptographically random temp file names, eliminating the path equivalence vulnerability. Fix commit f6c01d6577 by remm@apache.org was already in the upstream release when TuxCare imported version 10.1.55.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is NOT affected by CVE-2025-31650. The vulnerability affects versions 10.1.10 through 10.1.39, with fixes released in 10.1.40. Version 10.1.55 is newer and already contains all three upstream fixes from Apache (commits cba1a0fe12, 1eef1dc459, 8cc3b8fb3f) that were authored by Mark Thomas (markt@apache.org) and shipped in the upstream release before TuxCare onboarded this version in September 2026. The vulnerable code pattern (missing exception handling for invalid HTTP/2 priority headers) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is NOT affected by CVE-2025-31650. The vulnerability affects versions 10.1.10 through 10.1.39, with fixes released in 10.1.40. Version 10.1.55 is newer and already contains all three upstream fixes from Apache (commits cba1a0fe12, 1eef1dc459, 8cc3b8fb3f) that were authored by Mark Thomas (markt@apache.org) and shipped in the upstream release before TuxCare onboarded this version in September 2026. The vulnerable code pattern (missing exception handling for invalid HTTP/2 priority headers) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-31651 is NOT present in Apache Tomcat 10.1.55. The vulnerability affected versions 10.1.0-M1 through 10.1.39, and was fixed in upstream version 10.1.40. The target version 10.1.55 includes the complete upstream fix authored by Mark Thomas (markt@apache.org) in commit 066bf6b6a1, which was part of the upstream release onboarded by TuxCare. The fix adds encodeForRewrite() to properly encode literal '%', ';', and '?' characters before rewrite rule evaluation, preventing bypass attacks through URL manipulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "impact_statement": "CVE-2025-31651 is NOT present in Apache Tomcat 10.1.55. The vulnerability affected versions 10.1.0-M1 through 10.1.39, and was fixed in upstream version 10.1.40. The target version 10.1.55 includes the complete upstream fix authored by Mark Thomas (markt@apache.org) in commit 066bf6b6a1, which was part of the upstream release onboarded by TuxCare. The fix adds encodeForRewrite() to properly encode literal '%', ';', and '?' characters before rewrite rule evaluation, preventing bypass attacks through URL manipulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is NOT affected by CVE-2025-46701. The vulnerability (improper file/directory differentiation in CGI servlet's pathInfo parsing that allows security constraint bypass) was fixed in upstream Apache Tomcat commit 238d2aa (2025-05-02) by Mark Thomas. This fix was already present in the upstream 10.1.55 release (2026-05-05) when TuxCare onboarded it (2026-09-22). The target code uses WebResource API with explicit isFile() checks (lines 819, 832), preventing directories from being mistaken for CGI script files. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is NOT affected by CVE-2025-46701. The vulnerability (improper file/directory differentiation in CGI servlet's pathInfo parsing that allows security constraint bypass) was fixed in upstream Apache Tomcat commit 238d2aa (2025-05-02) by Mark Thomas. This fix was already present in the upstream 10.1.55 release (2026-05-05) when TuxCare onboarded it (2026-09-22). The target code uses WebResource API with explicit isFile() checks (lines 819, 832), preventing directories from being mistaken for CGI script files. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "impact_statement": "CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.55 is not affected by CVE-2025-48989 (the \"made you reset\" attack). The upstream fix commit 73c04a10395774bda71a0b37802cf983662ce255 by Mark Thomas was already included in the Apache Tomcat 10.1.55 release before TuxCare onboarded it. The fix adds overhead accounting for server-sent RST frames, preventing resource exhaustion by incrementing the overhead counter when the server sends RST_STREAM frames.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108; >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108), NVD (>= 9.0.1, < 9.0.108; >= 10.0.0, < 10.1.44; >= 11.0.0, < 11.0.10; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.9; >= 10.1.0-M1, <= 10.1.43; >= 9.0.0.M1, <= 9.0.107), Snyk (>= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10; >= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "impact_statement": "The target Apache Tomcat 10.1.55 is not affected by CVE-2025-48989 (the \"made you reset\" attack). The upstream fix commit 73c04a10395774bda71a0b37802cf983662ce255 by Mark Thomas was already included in the Apache Tomcat 10.1.55 release before TuxCare onboarded it. The fix adds overhead accounting for server-sent RST frames, preventing resource exhaustion by incrementing the overhead counter when the server sends RST_STREAM frames.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108; >= 11.0.0-M1, < 11.0.10; >= 10.1.0-M1, < 10.1.44; >= 9.0.0.M1, < 9.0.108), NVD (>= 9.0.1, < 9.0.108; >= 10.0.0, < 10.1.44; >= 11.0.0, < 11.0.10; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.9; >= 10.1.0-M1, <= 10.1.43; >= 9.0.0.M1, <= 9.0.107), Snyk (>= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10; >= 9.0.0.M1, < 9.0.108; >= 10.1.0-M1, < 10.1.44; >= 11.0.0-M1, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-49124 affects Apache Tomcat's Windows installer due to untrusted PATH search when calling icacls.exe. The target version (10.1.55) is newer than the fixed version (10.1.42). Analysis confirms the fix (using $SYSDIR\\icacls instead of icacls) was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The vulnerable pattern (unqualified icacls calls) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "impact_statement": "CVE-2025-49124 affects Apache Tomcat's Windows installer due to untrusted PATH search when calling icacls.exe. The target version (10.1.55) is newer than the fixed version (10.1.42). Analysis confirms the fix (using $SYSDIR\\icacls instead of icacls) was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The vulnerable pattern (unqualified icacls calls) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.55 is not affected by CVE-2025-52434. The vulnerability is specific to the APR/Native connector (AprEndpoint class), which was architecturally removed from Tomcat in version 10.1.0-M5 (September 2021), before version 10.1.55 was released. The CVE explicitly states it affects Tomcat 9.0.0.M1 through 9.0.106 and EOL 8.5.x versions, with no mention of Tomcat 10.x. The target repository contains only NioEndpoint and Nio2Endpoint implementations, which use different connection handling mechanisms. This is a Type A2 case where the vulnerable component (APR connector) does not exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "impact_statement": "Tomcat 10.1.55 is not affected by CVE-2025-52434. The vulnerability is specific to the APR/Native connector (AprEndpoint class), which was architecturally removed from Tomcat in version 10.1.0-M5 (September 2021), before version 10.1.55 was released. The CVE explicitly states it affects Tomcat 9.0.0.M1 through 9.0.106 and EOL 8.5.x versions, with no mention of Tomcat 10.x. The target repository contains only NioEndpoint and Nio2Endpoint implementations, which use different connection handling mechanisms. This is a Type A2 case where the vulnerable component (APR connector) does not exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-52520 (integer overflow in multipart upload size tracking) is NOT present in Apache Tomcat 10.1.55. The upstream fix by Mark Thomas (commit fc42bbccb9) was already included in the 10.1.55 release that TuxCare onboarded. The vulnerable pattern (32-bit int accumulator allowing wraparound to bypass maxPostSize) has been replaced with 64-bit long and Math.addExact() overflow detection at java/org/apache/catalina/connector/Request.java:2677-2693.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107; >= 10.1.0, < 10.1.43; >= 11.0.0, < 11.0.9), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "impact_statement": "CVE-2025-52520 (integer overflow in multipart upload size tracking) is NOT present in Apache Tomcat 10.1.55. The upstream fix by Mark Thomas (commit fc42bbccb9) was already included in the 10.1.55 release that TuxCare onboarded. The vulnerable pattern (32-bit int accumulator allowing wraparound to bypass maxPostSize) has been replaced with 64-bit long and Math.addExact() overflow detection at java/org/apache/catalina/connector/Request.java:2677-2693.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107; >= 10.1.0, < 10.1.43; >= 11.0.0, < 11.0.9), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2025-53506. The upstream fix (commit 2aa6261276ebe50b99276953591e3a2be7898bdb by Mark Thomas) that addresses the HTTP/2 resource exhaustion vulnerability was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix applies MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE limits immediately at connection initialization (force=true), preventing malicious clients from exhausting server resources by ignoring the initial SETTINGS frame acknowledgment. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9), NVD (>= 9.0.0, <= 9.0.106; >= 10.1.0, <= 10.1.42; >= 11.0.0, <= 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-53506"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2025-53506. The upstream fix (commit 2aa6261276ebe50b99276953591e3a2be7898bdb by Mark Thomas) that addresses the HTTP/2 resource exhaustion vulnerability was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix applies MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE limits immediately at connection initialization (force=true), preventing malicious clients from exhausting server resources by ignoring the initial SETTINGS frame acknowledgment. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9), NVD (>= 9.0.0, <= 9.0.106; >= 10.1.0, <= 10.1.42; >= 11.0.0, <= 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.1.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2025-55668. The session fixation vulnerability in the rewrite valve was fixed in upstream Apache Tomcat 10.1.42, and version 10.1.55 ships with this fix already applied. Both critical defense mechanisms are present: (1) redirect URLs are properly encoded with session IDs via response.encodeRedirectURL() at line 474, and (2) session information is re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.55 is not affected by CVE-2025-55668. The session fixation vulnerability in the rewrite valve was fixed in upstream Apache Tomcat 10.1.42, and version 10.1.55 ships with this fix already applied. Both critical defense mechanisms are present: (1) redirect URLs are properly encoded with session IDs via response.encodeRedirectURL() at line 474, and (2) session information is re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.55 is not affected by CVE-2025-55752. The vulnerability (normalizing before decoding URL-encoded path components, allowing encoded traversal sequences to bypass security checks for /WEB-INF/ and /META-INF/) was fixed in upstream Apache Tomcat 10.1.45. The fix commit (130d36d8492ef9e4eb22952c17c92423cb35fd06) was already present in the upstream 10.1.55 release that TuxCare onboarded. The RewriteValve.java code at lines 560-563 shows the correct fixed pattern: decode THEN normalize, preventing encoded path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "impact_statement": "Target version 10.1.55 is not affected by CVE-2025-55752. The vulnerability (normalizing before decoding URL-encoded path components, allowing encoded traversal sequences to bypass security checks for /WEB-INF/ and /META-INF/) was fixed in upstream Apache Tomcat 10.1.45. The fix commit (130d36d8492ef9e4eb22952c17c92423cb35fd06) was already present in the upstream 10.1.55 release that TuxCare onboarded. The RewriteValve.java code at lines 560-563 shows the correct fixed pattern: decode THEN normalize, preventing encoded path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.55 is NOT affected by CVE-2025-55754. The vulnerability (unescaped ANSI control characters in log output) is not present because the upstream vendor's fix was already included in the Apache Tomcat 10.1.55 release. The fix adds LogUtil.escape() which converts control characters to \\uNNNN format before logging, preventing ANSI escape sequence injection attacks on Windows consoles. All production log formatters (JdkLoggerFormatter, OneLineFormatter, JsonFormatter) properly escape control characters. VerbatimFormatter intentionally does not escape (documented design for access logs).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "impact_statement": "The target Apache Tomcat 10.1.55 is NOT affected by CVE-2025-55754. The vulnerability (unescaped ANSI control characters in log output) is not present because the upstream vendor's fix was already included in the Apache Tomcat 10.1.55 release. The fix adds LogUtil.escape() which converts control characters to \\uNNNN format before logging, preventing ANSI escape sequence injection attacks on Windows consoles. All production log formatters (JdkLoggerFormatter, OneLineFormatter, JsonFormatter) properly escape control characters. VerbatimFormatter intentionally does not escape (documented design for access logs).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-61795"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 10.1.55) is NOT affected by CVE-2025-66614. The vulnerability, which allowed client certificate authentication bypass via mismatched SNI and HTTP Host headers, was fixed in upstream Apache Tomcat version 10.1.50. Since the target is version 10.1.55, the fix was already present in the upstream release that TuxCare onboarded. The fix commit (972f9a5e2a) authored by remm@apache.org is an ancestor of HEAD and predates all TuxCare commits in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "impact_statement": "The target repository (Apache Tomcat 10.1.55) is NOT affected by CVE-2025-66614. The vulnerability, which allowed client certificate authentication bypass via mismatched SNI and HTTP Host headers, was fixed in upstream Apache Tomcat version 10.1.50. Since the target is version 10.1.55, the fix was already present in the upstream release that TuxCare onboarded. The fix commit (972f9a5e2a) authored by remm@apache.org is an ancestor of HEAD and predates all TuxCare commits in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 11.0.0-M1, < 11.0.15; >= 10.1.0-M1, < 10.1.50; >= 9.0.0-M1, < 9.0.113; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.1, < 9.0.113; >= 10.1.1, < 10.1.50; >= 11.0.1, < 11.0.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.14; >= 10.1.0-M1, <= 10.1.49; >= 9.0.0-M1, <= 9.0.112; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15; >= 8.5.0, < 9.0.113; >= 10.0.0-M1, < 10.1.50; >= 11.0.0-M1, < 11.0.15)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is NOT affected by CVE-2026-24734. The vulnerability affects Tomcat versions 10.1.0-M7 through 10.1.51, with the fix introduced in 10.1.52. The target version 10.1.55 already contains the upstream fix (commit e3b562d4cd) that was shipped as part of the Apache Tomcat 10.1.55 release. All required OCSP verification and freshness checks are present in the OpenSSL/Panama FFM implementation, including nonce verification, signature verification, and validity timestamp checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115; >= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115), NVD (>= 9.0.83, < 9.0.115; >= 10.1.1, < 10.1.52; >= 11.0.1, < 11.0.18; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9; >= 1.3.0, < 1.3.5; >= 2.0.0, < 2.0.12), cve.org (>= 1.1.23, <= 1.1.34; >= 1.2.0, <= 1.2.39; >= 1.3.0, <= 1.3.4; >= 2.0.0, <= 2.0.11; >= 11.0.0-M1, <= 11.0.17; >= 10.1.0-M7, <= 10.1.51; >= 9.0.83, <= 9.0.114), Snyk (>= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18; >= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is NOT affected by CVE-2026-24734. The vulnerability affects Tomcat versions 10.1.0-M7 through 10.1.51, with the fix introduced in 10.1.52. The target version 10.1.55 already contains the upstream fix (commit e3b562d4cd) that was shipped as part of the Apache Tomcat 10.1.55 release. All required OCSP verification and freshness checks are present in the OpenSSL/Panama FFM implementation, including nonce verification, signature verification, and validity timestamp checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115; >= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115), NVD (>= 9.0.83, < 9.0.115; >= 10.1.1, < 10.1.52; >= 11.0.1, < 11.0.18; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9; >= 1.3.0, < 1.3.5; >= 2.0.0, < 2.0.12), cve.org (>= 1.1.23, <= 1.1.34; >= 1.2.0, <= 1.2.39; >= 1.3.0, <= 1.3.4; >= 2.0.0, <= 2.0.11; >= 11.0.0-M1, <= 11.0.17; >= 10.1.0-M7, <= 10.1.51; >= 9.0.83, <= 9.0.114), Snyk (>= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18; >= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "impact_statement": "CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-29129 (cipher preference order not preserved). The vulnerability was fixed in upstream commit 8d69b33764 (February 20, 2026) by Apache committer remm@apache.org, which changed HashSet to LinkedHashSet in SSLHostConfig.getJsseCipherNames() to preserve insertion order. This fix was already present in the upstream 10.1.55 release that Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-29129 (cipher preference order not preserved). The vulnerability was fixed in upstream commit 8d69b33764 (February 20, 2026) by Apache committer remm@apache.org, which changed HashSet to LinkedHashSet in SSLHostConfig.getJsseCipherNames() to preserve insertion order. This fix was already present in the upstream 10.1.55 release that Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is not affected by CVE-2026-34483. The vulnerability (improper encoding/escaping of URI and query strings in JsonAccessLogValve) was fixed in upstream Apache Tomcat 10.1.54 (commit f22dc2ce6c by Mark Thomas). Version 10.1.55 already contains this fix from the upstream release. All URI and query string values are properly escaped via escapeAndAppend() before being written to access logs, preventing log injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.40, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.40, <= 9.0.116; >= 8.5.84, <= 8.5.100), Snyk (< 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is not affected by CVE-2026-34483. The vulnerability (improper encoding/escaping of URI and query strings in JsonAccessLogValve) was fixed in upstream Apache Tomcat 10.1.54 (commit f22dc2ce6c by Mark Thomas). Version 10.1.55 already contains this fix from the upstream release. All URI and query string values are properly escaped via escapeAndAppend() before being written to access logs, preventing log injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.40, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.40, <= 9.0.116; >= 8.5.84, <= 8.5.100), Snyk (< 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-34487. The vulnerability (Kubernetes bearer token exposure in log files) has been fixed by upstream Apache in commit 5eff2a773b8b728083e5195b3183df1b9e12a03d, which was already included in the 10.1.55 release that TuxCare onboarded. The CVE affects versions through 10.1.53 and is fixed in 10.1.54; since 10.1.55 > 10.1.54, the fix was already present in the upstream release. All three files show the patched version: AbstractStreamProvider.java removes headers from debug logs, TokenStreamProvider.java removes token from exception messages, and LocalStrings.properties updates message templates accordingly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.13, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.13, <= 9.0.116), Snyk (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "impact_statement": "Target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-34487. The vulnerability (Kubernetes bearer token exposure in log files) has been fixed by upstream Apache in commit 5eff2a773b8b728083e5195b3183df1b9e12a03d, which was already included in the 10.1.55 release that TuxCare onboarded. The CVE affects versions through 10.1.53 and is fixed in 10.1.54; since 10.1.55 > 10.1.54, the fix was already present in the upstream release. All three files show the patched version: AbstractStreamProvider.java removes headers from debug logs, TokenStreamProvider.java removes token from exception messages, and LocalStrings.properties updates message templates accordingly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.13, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.13, <= 9.0.116), Snyk (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target (Apache Tomcat 10.1.55) is not affected by CVE-2026-41284. The fix for unbounded WebDAV request body buffering was already present in the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded. The vulnerable pattern (unbounded ByteArrayOutputStream) has been replaced with BoundedByteArrayOutputStream enforcing a 4096-byte default limit on LOCK and PROPFIND request bodies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 4.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100; >= 4.0, <= 7.0.109), Snyk (>= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "impact_statement": "The target (Apache Tomcat 10.1.55) is not affected by CVE-2026-41284. The fix for unbounded WebDAV request body buffering was already present in the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded. The vulnerable pattern (unbounded ByteArrayOutputStream) has been replaced with BoundedByteArrayOutputStream enforcing a 4096-byte default limit on LOCK and PROPFIND request bodies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 4.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100; >= 4.0, <= 7.0.109), Snyk (>= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 10.1.55 is not affected by CVE-2026-41293. The vulnerability (unvalidated HTTP/2 headers allowing invalid characters to reach the application) was fixed in the upstream Apache Tomcat 10.1.55 release via commit 19f17a257797e8d139b33ff9c88d362a273be148 by Mark Thomas (markt@apache.org). TuxCare onboarded this version with the fix already present. All required validation code is in place: HPackHuffman.java and HpackDecoder.java validate characters during HPACK decoding, rejecting field names with non-token or uppercase characters and field values with invalid characters, and Http2Parser.java properly handles validation exceptions by throwing StreamException with PROTOCOL_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "impact_statement": "The target Tomcat 10.1.55 is not affected by CVE-2026-41293. The vulnerability (unvalidated HTTP/2 headers allowing invalid characters to reach the application) was fixed in the upstream Apache Tomcat 10.1.55 release via commit 19f17a257797e8d139b33ff9c88d362a273be148 by Mark Thomas (markt@apache.org). TuxCare onboarded this version with the fix already present. All required validation code is in place: HPackHuffman.java and HpackDecoder.java validate characters during HPACK decoding, rejecting field names with non-token or uppercase characters and field values with invalid characters, and Http2Parser.java properly handles validation exceptions by throwing StreamException with PROTOCOL_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.0, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository at version 10.1.55 is not affected by CVE-2026-42498. The vulnerability involves WebSocket authentication credentials being leaked to redirect target hosts. The fix, which removes authentication headers after successful authentication or redirects, was authored by upstream Apache (Mark Thomas, markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release. This fix is present in the target repository as commit 6cbe274592, which predates all TuxCare commits. The CVE itself states that version 10.1.55 is the fixed version (affected: 10.1.0-M1 to 10.1.54).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.2, <= 9.0.117; >= 8.5.24, <= 8.5.100; >= 7.0.83, <= 7.0.109), Snyk (>= 7.0.83, < 8.0.1; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "impact_statement": "The target repository at version 10.1.55 is not affected by CVE-2026-42498. The vulnerability involves WebSocket authentication credentials being leaked to redirect target hosts. The fix, which removes authentication headers after successful authentication or redirects, was authored by upstream Apache (Mark Thomas, markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release. This fix is present in the target repository as commit 6cbe274592, which predates all TuxCare commits. The CVE itself states that version 10.1.55 is the fixed version (affected: 10.1.0-M1 to 10.1.54).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.2, <= 9.0.117; >= 8.5.24, <= 8.5.100; >= 7.0.83, <= 7.0.109), Snyk (>= 7.0.83, < 8.0.1; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.55 is not vulnerable to CVE-2026-43512. The fix was included in the upstream Apache Tomcat 10.1.55 release (the first fixed version per CVE). The vulnerable pattern - where null passwords from non-existent users were converted to the string \"null\" in DIGEST authentication digest calculations - is not present. Upstream commit 3d4d3fae07 by Mark Thomas (markt@apache.org) added a null check that immediately returns null from getDigest() when getPassword() returns null, preventing the authentication bypass. This fix shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "impact_statement": "Apache Tomcat 10.1.55 is not vulnerable to CVE-2026-43512. The fix was included in the upstream Apache Tomcat 10.1.55 release (the first fixed version per CVE). The vulnerable pattern - where null passwords from non-existent users were converted to the string \"null\" in DIGEST authentication digest calculations - is not present. Upstream commit 3d4d3fae07 by Mark Thomas (markt@apache.org) added a null check that immediately returns null from getDigest() when getPassword() returns null, preventing the authentication bypass. This fix shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.55 repository is not affected by CVE-2026-43513. The vulnerability (improper handling of case sensitivity in LockOutRealm allowing lockout bypass via case-variant usernames) has been fixed by upstream commit 4a90d3fa93, which was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix adds username normalization to lowercase (when caseSensitive=false, the default) in all three critical methods: isLocked(), registerAuthSuccess(), and registerAuthFailure().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "impact_statement": "The target Apache Tomcat 10.1.55 repository is not affected by CVE-2026-43513. The vulnerability (improper handling of case sensitivity in LockOutRealm allowing lockout bypass via case-variant usernames) has been fixed by upstream commit 4a90d3fa93, which was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix adds username normalization to lowercase (when caseSensitive=false, the default) in all three critical methods: isLocked(), registerAuthSuccess(), and registerAuthFailure().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2026-43515 is NOT present in Apache Tomcat 10.1.55. The vulnerability (only first HTTP method constraint applied for extension patterns) was fixed by upstream Apache in commit c621317382682206fb58ab92ebd3e1b6fdd10ce9 by Mark Thomas, which shipped in the 10.1.55 release. The target code has the fixed pattern: 'matched' variable declared inside the collection loop, checking collection[j].findMethod(method) for each matching collection rather than only collection[pos] after the loop. TuxCare onboarded 10.1.55 with this upstream fix already present. CVE states fixed in 10.1.55+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "impact_statement": "CVE-2026-43515 is NOT present in Apache Tomcat 10.1.55. The vulnerability (only first HTTP method constraint applied for extension patterns) was fixed by upstream Apache in commit c621317382682206fb58ab92ebd3e1b6fdd10ce9 by Mark Thomas, which shipped in the 10.1.55 release. The target code has the fixed pattern: 'matched' variable declared inside the collection loop, checking collection[j].findMethod(method) for each matching collection rather than only collection[pos] after the loop. TuxCare onboarded 10.1.55 with this upstream fix already present. CVE states fixed in 10.1.55+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:53:26.697384+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 10.1.55-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}