{
  "@id": "urn:uuid:891b4294-d25f-4c48-93d1-cf0cbd05707f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 61,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:23:27.725950+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the \"name\" parameter was rendered without HTML escaping. The target (Tomcat 8.5.100) is NOT affected because the vulnerability was fixed by upstream Apache Tomcat in 2008, and this fix was already present in the upstream release when TuxCare adopted it. The code properly escapes all user-controlled...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the \"name\" parameter was rendered without HTML escaping. The target (Tomcat 8.5.100) is NOT affected because the vulnerability was fixed by upstream Apache Tomcat in 2008, and this fix was already present in the upstream release when TuxCare adopted it. The code properly escapes all user-controlled..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.100 is not affected by CVE-2014-0095. The vulnerability, which caused denial of service through thread consumption when processing AJP requests with Content-Length: 0, was fixed in the upstream release before TuxCare onboarded this version. The fix (commit 1bd7d41498 by Mark Thomas on March 17, 2014) properly handles zero-length content by setting endOfStream=true and returnin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is not affected by CVE-2014-0095. The vulnerability, which caused denial of service through thread consumption when processing AJP requests with Content-Length: 0, was fixed in the upstream release before TuxCare onboarded this version. The fix (commit 1bd7d41498 by Mark Thomas on March 17, 2014) properly handles zero-length content by setting endOfStream=true and returnin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 8.5.100 is not affected by CVE-2017-12615. The vulnerability existed in Tomcat 7.x's FileDirContext architecture where path validation was skipped for non-existent files during PUT operations. Tomcat 8.5.x uses a completely different WebResourceRoot/WebResourceSet architecture (introduced in 2012) that performs canonical path validation regardless of file existence. The defense in AbstractFileResourceSet.file() validates that the canonical path is within the allowed base directory even when mustExist=false, preventing the path traversal attack that CVE-2017-12615 exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Tomcat 8.5.100 is not affected by CVE-2017-12615. The vulnerability existed in Tomcat 7.x's FileDirContext architecture where path validation was skipped for non-existent files during PUT operations. Tomcat 8.5.x uses a completely different WebResourceRoot/WebResourceSet architecture (introduced in 2012) that performs canonical path validation regardless of file existence. The defense in AbstractFileResourceSet.file() validates that the canonical path is within the allowed base directory even when mustExist=false, preventing the path traversal attack that CVE-2017-12615 exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 CVE-2017-12617 has been fixed in the target repository. Both required patches preventing JSP upload via crafted HTTP PUT requests with trailing slashes are present in the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-12617 has been fixed in the target repository. Both required patches preventing JSP upload via crafted HTTP PUT requests with trailing slashes are present in the codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 affects Apache Tomcat 8.5.0-8.5.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 affects Apache Tomcat 8.5.0-8.5.11"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is NOT present in the target. The vulnerability allowed attackers to craft URLs that would cause the DefaultServlet's directory redirect to generate protocol-relative redirects (//evil.com), redirecting users to attacker-controlled URIs. The fix (stripping leading characters while charAt(1)=='/') is present at DefaultServlet.java:1374-1377 and was shipped in upstream Apache Tomca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 is NOT present in the target. The vulnerability allowed attackers to craft URLs that would cause the DefaultServlet's directory redirect to generate protocol-relative redirects (//evil.com), redirecting users to attacker-controlled URIs. The fix (stripping leading characters while charAt(1)=='/') is present at DefaultServlet.java:1374-1377 and was shipped in upstream Apache Tomca..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 CVE-2018-1304 affects Apache Tomcat 8.5.0 to 8.5.27 where security constraints with URL pattern \"\" (empty string) were not correctly handled, causing them to be ignored. The target repository is version 8.5.100-tuxcare.10, which is much newer than the affected range. The fix was incorporated into upstream Tomcat 8.5.28 on February 6, 2018 via commit 5af7c13cff. The fix is present in the current codebase at RealmBase.java line 577, which explicitly handles empty string patterns by treating them as matching the context root ('/').",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "already_fixed \u2014 CVE-2018-1304 affects Apache Tomcat 8.5.0 to 8.5.27 where security constraints with URL pattern \"\" (empty string) were not correctly handled, causing them to be ignored. The target repository is version 8.5.100-tuxcare.10, which is much newer than the affected range. The fix was incorporated into upstream Tomcat 8.5.28 on February 6, 2018 via commit 5af7c13cff. The fix is present in the current codebase at RealmBase.java line 577, which explicitly handles empty string patterns by treating them as matching the context root ('/')."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Version 8.5.100 is not vulnerable. Summary: CVE-2018-1305 is NOT present in the target repository. The vulnerable code pattern (lazy ServletSecurity annotation scanning) has been replaced with the fix (ServletSecurity annotations processed at web application startup). Target version 8.5.100 is newer than the affected range (8.5.0 to 8.5.27) and contains the fix applied in version 8.5.28.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "Version 8.5.100 is not vulnerable. Summary: CVE-2018-1305 is NOT present in the target repository. The vulnerable code pattern (lazy ServletSecurity annotation scanning) has been replaced with the fix (ServletSecurity annotations processed at web application startup). Target version 8.5.100 is newer than the affected range (8.5.0 to 8.5.27) and contains the fix applied in version 8.5.28."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 CVE-2018-1336 has been fixed in Tomcat 8.5.100. The vulnerability involving improper overflow handling in the UTF-8 decoder with supplementary characters was addressed in version 8.5.31 (commit e00812b94e, April 27, 2018). The fix is present in the primary decoding path (decodeHasArray method, lines 270-275), which handles array-backed buffers - the common case in Tomcat's usage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "already_fixed \u2014 CVE-2018-1336 has been fixed in Tomcat 8.5.100. The vulnerability involving improper overflow handling in the UTF-8 decoder with supplementary characters was addressed in version 8.5.31 (commit e00812b94e, April 27, 2018). The fix is present in the primary decoding path (decodeHasArray method, lines 270-275), which handles array-backed buffers - the common case in Tomcat's usage."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8014. Confirmed by manual code inspection and security advisories.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8014. Confirmed by manual code inspection and security advisories."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8034. Confirmed by manual code inspection and security advisories.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8034. Confirmed by manual code inspection and security advisories."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T01:23:00.136176+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.100-tuxcare.10 is not affected by CVE-2018-8037. The vulnerability (race condition in async request handling causing cross-user response leakage) was fixed by Apache upstream in June 2018, seven years before TuxCare adopted this codebase (May 2025). Both components of the fix are present: (1) generation counter tracking to prevent stale async timeout processing (commit 71a8b09...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100-tuxcare.10 is not affected by CVE-2018-8037. The vulnerability (race condition in async request handling causing cross-user response leakage) was fixed by Apache upstream in June 2018, seven years before TuxCare adopted this codebase (May 2025). Both components of the fix are present: (1) generation counter tracking to prevent stale async timeout processing (commit 71a8b09..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 is not present in the target. All three defense mechanisms from the vendor patches are present and actively enforced in the codebase: (1) stream read timeout with 20s default enforced at Stream.java:1263-1280, (2) stream write timeout with 20s default enforced at Stream.java:254-258, (3) overhead frame counting enforced at Http2UpgradeHandler.java:387-391. The fixes were authored by Mark Thomas (markt@apache.org) in February 2019 (commits 2c5939e1, 65f4b6d1, and related) and shipped in Apache Tomcat 8.5.38. Target version 8.5.100 (released January 2024) is based on an upstream release that includes all CVE-2019-0199 fixes. The fix commit is an ancestor of the 8.5.100 tag and predates the first TuxCare commit (0ee1c76d) in this repository's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 is not present in the target. All three defense mechanisms from the vendor patches are present and actively enforced in the codebase: (1) stream read timeout with 20s default enforced at Stream.java:1263-1280, (2) stream write timeout with 20s default enforced at Stream.java:254-258, (3) overhead frame counting enforced at Http2UpgradeHandler.java:387-391. The fixes were authored by Mark Thomas (markt@apache.org) in February 2019 (commits 2c5939e1, 65f4b6d1, and related) and shipped in Apache Tomcat 8.5.38. Target version 8.5.100 (released January 2024) is based on an upstream release that includes all CVE-2019-0199 fixes. The fix commit is an ancestor of the 8.5.100 tag and predates the first TuxCare commit (0ee1c76d) in this repository's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat 8.5.0 to 8.5.39. The target version is 8.5.100, which is 61 minor versions beyond the affected range. The vulnerability (unescaped output in SSI printenv command) has been fixed in the target code. The file java/org/apache/catalina/ssi/SSIPrintenv.java line 44 uses `ssiMediator.getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)` which applies HTML en...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects Apache Tomcat 8.5.0 to 8.5.39. The target version is 8.5.100, which is 61 minor versions beyond the affected range. The vulnerability (unescaped output in SSI printenv command) has been fixed in the target code. The file java/org/apache/catalina/ssi/SSIPrintenv.java line 44 uses `ssiMediator.getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)` which applies HTML en..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 fix was already present in upstream Apache Tomcat 8.5.100 before TuxCare onboarded this version. The target contains complete defense implementation: (1) cmdLineArgumentsDecoded pattern validation that restricts decoded CGI arguments to safe characters on Windows ([\\\\w\\\\Q-.\\\\/:\\\\E]+), (2) enableCmdLineArguments disabled by default, and (3) validation logic that rejects requests with forbidden characters. Fix commit 5bc4e6d7b1 authored by markt@apache.org was included in the upstream release, confirmed by ancestry analysis showing it predates TuxCare's first commit e0a4054d041b.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 fix was already present in upstream Apache Tomcat 8.5.100 before TuxCare onboarded this version. The target contains complete defense implementation: (1) cmdLineArgumentsDecoded pattern validation that restricts decoded CGI arguments to safe characters on Windows ([\\\\w\\\\Q-.\\\\/:\\\\E]+), (2) enableCmdLineArguments disabled by default, and (3) validation logic that rejects requests with forbidden characters. Fix commit 5bc4e6d7b1 authored by markt@apache.org was included in the upstream release, confirmed by ancestry analysis showing it predates TuxCare's first commit e0a4054d041b.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 8.5.100-tuxcare.10 is not affected by CVE-2019-10072. The vulnerability pattern (indefinite thread blocking on connection window exhaustion) has been removed by an upstream fix that was already present in the Tomcat 8.5.100 release. The defense code adds timeout handling to connection window allocation waits and properly closes connections/streams when timeouts expire without allocation, preventing the DoS condition. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "The target Apache Tomcat 8.5.100-tuxcare.10 is not affected by CVE-2019-10072. The vulnerability pattern (indefinite thread blocking on connection window exhaustion) has been removed by an upstream fix that was already present in the Tomcat 8.5.100 release. The defense code adds timeout handling to connection window allocation waits and properly closes connections/streams when timeouts expire without allocation, preventing the DoS condition. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 affects JmxRemoteLifecycleListener, which creates a mutable RMI registry allowing local attackers to manipulate registry bindings and perform man-in-the-middle attacks to capture JMX credentials. The target version 8.5.100-tuxcare.10 is NOT affected because the entire JmxRemoteLifecycleListener component was removed from the Apache Tomcat codebase by upstream commit 1b9e8fd1f4 (Jan 11, 2022, by Mark Thomas) before version 8.5.100 was released (Mar 19, 2024). The vulnerable code does not exist in the target. No alternative RMI registry creation for remote JMX exists in the codebase. The tribes JmxRegistry found in the repo is a different component for local MBean management and does not create RMI registries.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 affects JmxRemoteLifecycleListener, which creates a mutable RMI registry allowing local attackers to manipulate registry bindings and perform man-in-the-middle attacks to capture JMX credentials. The target version 8.5.100-tuxcare.10 is NOT affected because the entire JmxRemoteLifecycleListener component was removed from the Apache Tomcat codebase by upstream commit 1b9e8fd1f4 (Jan 11, 2022, by Mark Thomas) before version 8.5.100 was released (Mar 19, 2024). The vulnerable code does not exist in the target. No alternative RMI registry creation for remote JMX exists in the codebase. The tribes JmxRegistry found in the repo is a different component for local MBean management and does not create RMI registries.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 session fixation vulnerability is NOT present in target Apache Tomcat 8.5.100. The upstream fix was applied in commit e19a202ee43b6e2a538be5515ae0ab32d8ef112c (2019-12-05) by Mark Thomas and refined in commit d0498e73705 (2019-12-11) by Konstantin Kolinko. Both commits are ancestors of the first TuxCare commit, meaning the fix was already present in the upstream release that TuxCare onboarded. All critical fix patterns are present: checkForCachedAuthentication() is called after request restoration, register() is called immediately after authentication, FORM_PRINCIPAL_NOTE is deprecated and unused, and matchRequest() correctly checks based on the cache flag.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 session fixation vulnerability is NOT present in target Apache Tomcat 8.5.100. The upstream fix was applied in commit e19a202ee43b6e2a538be5515ae0ab32d8ef112c (2019-12-05) by Mark Thomas and refined in commit d0498e73705 (2019-12-11) by Konstantin Kolinko. Both commits are ancestors of the first TuxCare commit, meaning the fix was already present in the upstream release that TuxCare onboarded. All critical fix patterns are present: checkForCachedAuthentication() is called after request restoration, register() is called immediately after authentication, FORM_PRINCIPAL_NOTE is deprecated and unused, and matchRequest() correctly checks based on the cache flag.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 8.5.100-tuxcare.10. The vulnerability was a regression where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix (commit 959f1dfd767 by Mark Thomas, 2019-12-17) validates Transfer-Encoding headers and rejects invalid ones with a 400 Bad Request response. This fix was already present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 8.5.100-tuxcare.10. The vulnerability was a regression where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix (commit 959f1dfd767 by Mark Thomas, 2019-12-17) validates Transfer-Encoding headers and rejects invalid ones with a 400 Bad Request response. This fix was already present i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Tomcat 8.5.100 already contains the CVE-2020-1935 fix from upstream Apache commit 8fbe2e962f by Mark Thomas. The fix was present in the upstream release before TuxCare adopted this version. The defense code at Http11InputBuffer.java:978-983 enforces strict CRLF validation (rejects CR not followed by LF) and blocks control characters in header values (except TAB), preventing the HTTP requ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 8.5.100 already contains the CVE-2020-1935 fix from upstream Apache commit 8fbe2e962f by Mark Thomas. The fix was present in the upstream release before TuxCare adopted this version. The defense code at Http11InputBuffer.java:978-983 enforces strict CRLF validation (rejects CR not followed by LF) and blocks control characters in header values (except TAB), preventing the HTTP requ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is NOT present in Apache Tomcat 8.5.100. All required fixes for this vulnerability were included in the upstream Apache Tomcat 8.5.100 release, which is significantly later than version 8.5.51 where the vulnerability was originally patched. The fixes include: (1) AJP connector binding to loopback address by default instead of all interfaces, (2) secret/requiredSecret authentication with secretRequired defaulting to true, (3) allowedRequestAttributesPattern validation to prevent arbitrary attribute injection, (4) secret validation logic that returns 403 for missing or incorrect secrets, and (5) AJP connector disabled by default in server.xml. These defenses prevent the attack chain where malicious AJP requests with manipulated servlet attributes could read arbitrary files or execute code via JSP processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is NOT present in Apache Tomcat 8.5.100. All required fixes for this vulnerability were included in the upstream Apache Tomcat 8.5.100 release, which is significantly later than version 8.5.51 where the vulnerability was originally patched. The fixes include: (1) AJP connector binding to loopback address by default instead of all interfaces, (2) secret/requiredSecret authentication with secretRequired defaulting to true, (3) allowedRequestAttributesPattern validation to prevent arbitrary attribute injection, (4) secret validation logic that returns 403 for missing or incorrect secrets, and (5) AJP connector disabled by default in server.xml. These defenses prevent the attack chain where malicious AJP requests with manipulated servlet attributes could read arbitrary files or execute code via JSP processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 The target Tomcat 8.5.100 repository already contains the fix for CVE-2020-9484. Path traversal validation was added to FileStore.java to prevent deserialization of attacker-controlled files outside the session storage directory. The fix is present at lines 347-350 using the improved Path API approach from the vendor's later commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "already_fixed \u2014 The target Tomcat 8.5.100 repository already contains the fix for CVE-2020-9484. Path traversal validation was added to FileStore.java to prevent deserialization of attacker-controlled files outside the session storage directory. The fix is present at lines 347-350 using the improved Path API approach from the vendor's later commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 8.5.0-8.5.59",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 8.5.0-8.5.59"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.100 is not affected by CVE-2021-25122. All four BZ 64830 fixes addressing h2c request corruption (HPACK decoder concurrency, processor recycling, thread-safe settings maps, leftover input timing) are present in HEAD. The fixes were authored by upstream Apache committer Mark Thomas (markt@apache.org) and shipped in the upstream 8.5.100 release before TuxCare onboarded it. The vulnerable code patterns have been replaced with the fixed versions: HpackDecoder uses local StringBuilder instead of shared instance, ConnectionSettingsBase uses ConcurrentHashMap instead of HashMap/EnumMap, AbstractProtocol properly releases processors before h2c upgrade, and restores leftover input at the correct time.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "Apache Tomcat 8.5.100 is not affected by CVE-2021-25122. All four BZ 64830 fixes addressing h2c request corruption (HPACK decoder concurrency, processor recycling, thread-safe settings maps, leftover input timing) are present in HEAD. The fixes were authored by upstream Apache committer Mark Thomas (markt@apache.org) and shipped in the upstream 8.5.100 release before TuxCare onboarded it. The vulnerable code patterns have been replaced with the fixed versions: HpackDecoder uses local StringBuilder instead of shared instance, ConnectionSettingsBase uses ConcurrentHashMap instead of HashMap/EnumMap, AbstractProtocol properly releases processors before h2c upgrade, and restores leftover input at the correct time.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 fix is present in target Tomcat 8.5.100. The vulnerability involved incomplete path traversal checking using string-based canonical path comparisons that could be bypassed in edge cases. The fix (commit 93f0cc403a by upstream Apache Tomcat, Jan 2021) replaced string-based checks with Path-based directory containment validation across all affected files (FileStore.java, DefaultServlet.java, ExpandWar.java, HostConfig.java, ContextConfig.java). This fix shipped in upstream Tomcat 8.5.62 and is present in 8.5.100. Target version is not affected because the vulnerable code pattern was already removed by the upstream vendor before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 fix is present in target Tomcat 8.5.100. The vulnerability involved incomplete path traversal checking using string-based canonical path comparisons that could be bypassed in edge cases. The fix (commit 93f0cc403a by upstream Apache Tomcat, Jan 2021) replaced string-based checks with Path-based directory containment validation across all affected files (FileStore.java, DefaultServlet.java, ExpandWar.java, HostConfig.java, ContextConfig.java). This fix shipped in upstream Tomcat 8.5.62 and is present in 8.5.100. Target version is not affected because the vulnerable code pattern was already removed by the upstream vendor before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252: Target Tomcat 8.5.100 is NOT AFFECTED. The vulnerability (accepting invalid Content-Length headers when rejectIllegalHeader=false, enabling request smuggling) is not present because the upstream fix was already included in the 8.5.100 release. The fix validates Content-Length header syntax and always rejects malformed Content-Length headers with a 400 response, overriding the rejectIllegalHeader configuration. Fix authored by Mark Thomas (Apache upstream) in commit a1c07906d8d, dated 2022-10-03, which predates TuxCare's onboarding of 8.5.100. CVE affected versions: 8.5.0-8.5.82; target is 8.5.100 (above the affected range).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "CVE-2022-42252: Target Tomcat 8.5.100 is NOT AFFECTED. The vulnerability (accepting invalid Content-Length headers when rejectIllegalHeader=false, enabling request smuggling) is not present because the upstream fix was already included in the 8.5.100 release. The fix validates Content-Length header syntax and always rejects malformed Content-Length headers with a 400 response, overriding the rejectIllegalHeader configuration. Fix authored by Mark Thomas (Apache upstream) in commit a1c07906d8d, dated 2022-10-03, which predates TuxCare's onboarding of 8.5.100. CVE affected versions: 8.5.0-8.5.82; target is 8.5.100 (above the affected range).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 (DoS via unlimited file upload parts) is not present in Apache Tomcat 8.5.100. The complete fix was shipped in the upstream Apache release before TuxCare adoption. All defense components are present: the fileCountMax field, getter/setter methods, FileCountLimitExceededException class, the check in FileUploadBase.parseRequest() that throws an exception when items.size() == fileCountMax, and Request.java integration that sets the limit based on connector configuration (maxParameterCount/maxPartCount). The fix was introduced in upstream commit 9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e by Mark Thomas (markt@apache.org), confirmed as an ancestor of the first TuxCare commit e0a4054d041b17553040c75fe87456e3d37c136a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 (DoS via unlimited file upload parts) is not present in Apache Tomcat 8.5.100. The complete fix was shipped in the upstream Apache release before TuxCare adoption. All defense components are present: the fileCountMax field, getter/setter methods, FileCountLimitExceededException class, the check in FileUploadBase.parseRequest() that throws an exception when items.size() == fileCountMax, and Request.java integration that sets the limit based on connector configuration (maxParameterCount/maxPartCount). The fix was introduced in upstream commit 9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e by Mark Thomas (markt@apache.org), confirmed as an ancestor of the first TuxCare commit e0a4054d041b17553040c75fe87456e3d37c136a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 is NOT present in Tomcat 8.5.100-tuxcare.10. The vulnerability involved an off-by-one error in parameter counting that allowed bypassing maxParameterCount limits. The fix was already included in the upstream Apache Tomcat 8.5.100 release (commit 5badf94e79e5 by Mark Thomas, 2023-04-11) before TuxCare onboarded this version. The current code correctly checks the limit BEFORE incrementing the counter and uses >= comparison, preventing the bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "CVE-2023-28709 is NOT present in Tomcat 8.5.100-tuxcare.10. The vulnerability involved an off-by-one error in parameter counting that allowed bypassing maxParameterCount limits. The fix was already included in the upstream Apache Tomcat 8.5.100 release (commit 5badf94e79e5 by Mark Thomas, 2023-04-11) before TuxCare onboarded this version. The current code correctly checks the limit BEFORE incrementing the counter and uses >= comparison, preventing the bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. The target (Apache Tomcat 8.5.100-tuxcare.10) is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced by the fix for bug 66512 (commit 23e6451af2, March 6, 2023), where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests. This regression was fixed by upstream in commit 2214c80305 (bug 66591, May 3, 2023), which restructured the code to ensure SEND_HEADERS is always sent even when numHeaders=0. The fix was already present in the upstream release that TuxCare onboarded, making this an upstream-resolved issue.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "The target (Apache Tomcat 8.5.100-tuxcare.10) is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced by the fix for bug 66512 (commit 23e6451af2, March 6, 2023), where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests. This regression was fixed by upstream in commit 2214c80305 (bug 66591, May 3, 2023), which restructured the code to ensure SEND_HEADERS is always sent even when numHeaders=0. The fix was already present in the upstream release that TuxCare onboarded, making this an upstream-resolved issue.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T00:47:50.558433+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset) was fixed in upstream Apache Tomcat commit 944332bb15 on Oct 5, 2023 by Mark Thomas. This fix was included in the Tomcat 8.5.100 release (Mar 19, 2024) before TuxCare onboarded the version (May 7, 2025). The target repository contains the complete mitigation: overheadResetFactor (default 50) is applied to RST_STREAM frames, and connections exceeding the overhead limit are closed. The vulnerable pattern is not present because the upstream vendor shipped the fix in this release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) was fixed in upstream Apache Tomcat commit 944332bb15 on Oct 5, 2023 by Mark Thomas. This fix was included in the Tomcat 8.5.100 release (Mar 19, 2024) before TuxCare onboarded the version (May 7, 2025). The target repository contains the complete mitigation: overheadResetFactor (default 50) is applied to RST_STREAM frames, and connections exceeding the overhead limit are closed. The vulnerable pattern is not present because the upstream vendor shipped the fix in this release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T19:05:19.418788+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.100-tuxcare.10 is NOT AFFECTED by CVE-2023-46589. The target version 8.5.100 is after the fixed version 8.5.96, and the upstream Apache fix (commit c83fe47725 by Mark Thomas) was already present in the 8.5.100 release that TuxCare onboarded. The vulnerable pattern (missing character validation in HTTP trailer header parsing) is not present in the target code. Both critical validation checks are implemented: HttpParser.isToken() for header names (ChunkedInputFilter.java:576-578) and HttpParser.isControl() for header values (ChunkedInputFilter.java:642-643). The fix was authored by the upstream vendor (markt@apache.org), not by TuxCare, and was included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "Apache Tomcat 8.5.100-tuxcare.10 is NOT AFFECTED by CVE-2023-46589. The target version 8.5.100 is after the fixed version 8.5.96, and the upstream Apache fix (commit c83fe47725 by Mark Thomas) was already present in the 8.5.100 release that TuxCare onboarded. The vulnerable pattern (missing character validation in HTTP trailer header parsing) is not present in the target code. Both critical validation checks are implemented: HttpParser.isToken() for header names (ChunkedInputFilter.java:576-578) and HttpParser.isControl() for header values (ChunkedInputFilter.java:642-643). The fix was authored by the upstream vendor (markt@apache.org), not by TuxCare, and was included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T18:41:44.135768+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 8.5.100-tuxcare.10 is NOT AFFECTED by CVE-2024-21733. The vulnerability involves generation of error messages containing sensitive information when I/O is not allowed. The upstream Apache fix (commit 0ff1ed325d2a35c64a12c36f2bfd1959f66413f2 and 9b44626e136c89a107dd4458ad4bde6123359fd6, both authored by markt@apache.org in Feb 2021) was already included in the upstream Tomca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100-tuxcare.10 is NOT AFFECTED by CVE-2024-21733. The vulnerability involves generation of error messages containing sensitive information when I/O is not allowed. The upstream Apache fix (commit 0ff1ed325d2a35c64a12c36f2bfd1959f66413f2 and 9b44626e136c89a107dd4458ad4bde6123359fd6, both authored by markt@apache.org in Feb 2021) was already included in the upstream Tomca..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. The target (Apache Tomcat 8.5.100-tuxcare.10) is not affected by CVE-2024-24549. The vulnerability was fixed by upstream Apache in commit 0cac540a88 (authored by markt@apache.org on Jan 25, 2024) and included in the Apache Tomcat 8.5.100 release (tagged March 19, 2024). TuxCare adopted version 8.5.100 which already contained the fix. The vulnerable pattern (delayed validation of HTTP/2 headers until all frames are processed) is absent from the target code. CVE affects versions \"8.5.0 through 8.5.98\" and recommends upgrading to 8.5.99+; target is 8.5.100.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "The target (Apache Tomcat 8.5.100-tuxcare.10) is not affected by CVE-2024-24549. The vulnerability was fixed by upstream Apache in commit 0cac540a88 (authored by markt@apache.org on Jan 25, 2024) and included in the Apache Tomcat 8.5.100 release (tagged March 19, 2024). TuxCare adopted version 8.5.100 which already contained the fix. The vulnerable pattern (delayed validation of HTTP/2 headers until all frames are processed) is absent from the target code. CVE affects versions \"8.5.0 through 8.5.98\" and recommends upgrading to 8.5.99+; target is 8.5.100."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-52317"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.100-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.100-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.100-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.100-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.100 is NOT affected by CVE-2026-29129. The vulnerability was introduced in newer versions (9.0.114-115, 10.1.51-52, 11.0.16-18) when TLS 1.3 specific cipher configuration was added. The vulnerable code pattern (using HashSet to combine TLS 1.3 and legacy cipher lists, losing configured preference order) does not exist in version 8.5.100, which lacks separate TLS 1.3 cipher con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is NOT affected by CVE-2026-29129. The vulnerability was introduced in newer versions (9.0.114-115, 10.1.51-52, 11.0.16-18) when TLS 1.3 specific cipher configuration was added. The vulnerable code pattern (using HashSet to combine TLS 1.3 and legacy cipher lists, losing configured preference order) does not exist in version 8.5.100, which lacks separate TLS 1.3 cipher con..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T17:23:27.725950+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:25.894192+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T17:20:00.095414+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 does not affect version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.100-tuxcare.8 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.100-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 8.5.100-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}