{
  "@id": "urn:uuid:5e55923d-5eed-45ea-a070-eb6d1e644258",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T11:56:56.665549+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is not present in Tomcat 8.5.46. The XSS vulnerability in the host-manager's /html/add endpoint has been fixed by the upstream Apache project. The target code properly escapes all user-supplied input (including the 'name' parameter) using Escape.htmlElementContent() before rendering it in HTML, preventing script injection. This fix was included in the upstream 8.5.46 release (Sept...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is not present in Tomcat 8.5.46. The XSS vulnerability in the host-manager's /html/add endpoint has been fixed by the upstream Apache project. The target code properly escapes all user-supplied input (including the 'name' parameter) using Escape.htmlElementContent() before rendering it in HTML, preventing script injection. This fix was included in the upstream 8.5.46 release (Sept..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 is NOT present in Apache Tomcat 8.5.46. The vulnerability, which allowed remote attackers to cause denial of service via Content-Length: 0 AJP requests, was fixed upstream by Apache in commit 1bd7d41498 on 2014-03-17. This fix was already included in the upstream Tomcat 8.5.46 release that TuxCare onboarded. The current code explicitly handles Content-Length: 0 requests by setting...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 is NOT present in Apache Tomcat 8.5.46. The vulnerability, which allowed remote attackers to cause denial of service via Content-Length: 0 AJP requests, was fixed upstream by Apache in commit 1bd7d41498 on 2014-03-17. This fix was already included in the upstream Tomcat 8.5.46 release that TuxCare onboarded. The current code explicitly handles Content-Length: 0 requests by setting..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 explicitly affects Apache Tomcat 7.0.0 to 7.0.79 only, not 8.5.x versions. The vulnerability exists in Tomcat 7.0.x's FileDirContext class where file write operations could bypass validation, allowing specially crafted Windows filenames (like `file.jsp::$DATA` or `file.jsp `) to upload JSP files. Tomcat 8.5.46 uses a completely different architecture (WebResourceRoot/WebResource API) where ALL file operations are centrally validated through AbstractFileResourceSet.file(), which includes Windows-specific filename checks, canonical path validation, and path comparison that prevents filename manipulation attacks. The vulnerable code pattern from 7.0.x does not exist in 8.5.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 explicitly affects Apache Tomcat 7.0.0 to 7.0.79 only, not 8.5.x versions. The vulnerability exists in Tomcat 7.0.x's FileDirContext class where file write operations could bypass validation, allowing specially crafted Windows filenames (like `file.jsp::$DATA` or `file.jsp `) to upload JSP files. Tomcat 8.5.46 uses a completely different architecture (WebResourceRoot/WebResource API) where ALL file operations are centrally validated through AbstractFileResourceSet.file(), which includes Windows-specific filename checks, canonical path validation, and path comparison that prevents filename manipulation attacks. The vulnerable code pattern from 7.0.x does not exist in 8.5.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target is stock Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, authored by markt@apache.org). CVE-2017-5651 is the send-file-processing regression where a Processor could be added to the processor cache twice (fixed upstream in 8.5.13 / 9.0.0.M19 via BZ 60918). The affected range is 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18; 8.5.46 is well past that. Code inspection of java/org/apache/coyote/http11/Http11Processor.java confirms the full post-fix implementation is present and the pre-fix pattern is absent. The service loop declares SendfileState sendfileState = SendfileState.DONE (line 675), gates the keep-alive loop on sendfileState == SendfileState.DONE (line 678), calls sendfileState = processSendfile(socketWrapper) (line 867), and returns SocketState.SENDFILE exactly once when sendfileState == SendfileState.PENDING (lines 879-880). The method processSendfile(...) (lines 1678-1706) returns a SendfileState and only nulls sendfileData inside its own switch. The vulnerable pre-fix markers breakKeepAliveLoop() (boolean) and sendingWithSendfile are entirely absent (0 grep matches). The exact upstream patch commit 494429ca21 is in the target history and reachable from HEAD. This is an upstream/vendor fix already baked into the shipped version, not a TuxCare backport, so the vulnerable pattern is not present in HEAD => not_affected (code_not_present).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "Target is stock Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, authored by markt@apache.org). CVE-2017-5651 is the send-file-processing regression where a Processor could be added to the processor cache twice (fixed upstream in 8.5.13 / 9.0.0.M19 via BZ 60918). The affected range is 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18; 8.5.46 is well past that. Code inspection of java/org/apache/coyote/http11/Http11Processor.java confirms the full post-fix implementation is present and the pre-fix pattern is absent. The service loop declares SendfileState sendfileState = SendfileState.DONE (line 675), gates the keep-alive loop on sendfileState == SendfileState.DONE (line 678), calls sendfileState = processSendfile(socketWrapper) (line 867), and returns SocketState.SENDFILE exactly once when sendfileState == SendfileState.PENDING (lines 879-880). The method processSendfile(...) (lines 1678-1706) returns a SendfileState and only nulls sendfileData inside its own switch. The vulnerable pre-fix markers breakKeepAliveLoop() (boolean) and sendingWithSendfile are entirely absent (0 grep matches). The exact upstream patch commit 494429ca21 is in the target history and reachable from HEAD. This is an upstream/vendor fix already baked into the shipped version, not a TuxCare backport, so the vulnerable pattern is not present in HEAD => not_affected (code_not_present)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 8.5.46 is NOT AFFECTED by CVE-2018-11784. The vulnerability involved the DefaultServlet's doDirectoryRedirect method generating protocol-relative redirects (URLs starting with \"//\"), allowing attackers to redirect users to arbitrary domains by crafting malicious request URIs. The upstream fix (commit f9f147359b by Mark Thomas, dated 2018-09-04) that strips leading slash...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 8.5.46 is NOT AFFECTED by CVE-2018-11784. The vulnerability involved the DefaultServlet's doDirectoryRedirect method generating protocol-relative redirects (URLs starting with \"//\"), allowing attackers to redirect users to arbitrary domains by crafting malicious request URIs. The upstream fix (commit f9f147359b by Mark Thomas, dated 2018-09-04) that strips leading slash..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target is Apache Tomcat 8.5.46 (HEAD tag confirmed, SHA 914f68b4). CVE-2018-1304: a security constraint whose URL pattern is the empty string \"\" (which maps to the context root) was ignored in RealmBase.findSecurityConstraints, letting unauthorised users reach the protected context root. The upstream fix (bug 62067) makes two changes in java/org/apache/catalina/realm/RealmBase.java: (1) normalise an empty/null request URI to \"/\", and (2) treat an empty-string pattern as matching the context-root URI \"/\". The target already contains BOTH changes verbatim \u2014 line 557 `if (uri == null || uri.length() == 0) { uri = \"/\"; }` and line 590 `if(uri.equals(patterns[k]) || patterns[k].length() == 0 && uri.equals(\"/\"))` with the comment \"Exact match including special case for the context root.\" git blame attributes both lines to upstream commit 5af7c13cff7 (Mark Thomas <markt@apache.org>, 2018-02-06, the 8.5.x branch fix listed in the patch set). The commit is an ancestor of HEAD and was shipped in the upstream 8.5.46 release \u2014 not a TuxCare backport. Verdict: not_affected (upstream vendor fix already present; justification code_not_present).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "Target is Apache Tomcat 8.5.46 (HEAD tag confirmed, SHA 914f68b4). CVE-2018-1304: a security constraint whose URL pattern is the empty string \"\" (which maps to the context root) was ignored in RealmBase.findSecurityConstraints, letting unauthorised users reach the protected context root. The upstream fix (bug 62067) makes two changes in java/org/apache/catalina/realm/RealmBase.java: (1) normalise an empty/null request URI to \"/\", and (2) treat an empty-string pattern as matching the context-root URI \"/\". The target already contains BOTH changes verbatim \u2014 line 557 `if (uri == null || uri.length() == 0) { uri = \"/\"; }` and line 590 `if(uri.equals(patterns[k]) || patterns[k].length() == 0 && uri.equals(\"/\"))` with the comment \"Exact match including special case for the context root.\" git blame attributes both lines to upstream commit 5af7c13cff7 (Mark Thomas <markt@apache.org>, 2018-02-06, the 8.5.x branch fix listed in the patch set). The commit is an ancestor of HEAD and was shipped in the upstream 8.5.46 release \u2014 not a TuxCare backport. Verdict: not_affected (upstream vendor fix already present; justification code_not_present)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target is Apache Tomcat at tag 8.5.46 (HEAD 914f68b451). CVE-2018-1305 affected 8.5.0\u20138.5.27 and was fixed upstream in 8.5.28 by commit 2349801827 (Mark Thomas, markt@apache.org): \"Process all ServletSecurity annotations at web application start rather than at servlet load time to ensure constraints are applied consistently.\" That commit is an ancestor of HEAD and the full post-fix state is present in the target. The vulnerable lazy-registration pattern is absent, so the target is not affected. The fix is upstream-authored (apache.org domain, not TuxCare/CloudLinux), so the verdict is not_affected (vendor-fix branch) with justification code_not_present, rather than already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "Target is Apache Tomcat at tag 8.5.46 (HEAD 914f68b451). CVE-2018-1305 affected 8.5.0\u20138.5.27 and was fixed upstream in 8.5.28 by commit 2349801827 (Mark Thomas, markt@apache.org): \"Process all ServletSecurity annotations at web application start rather than at servlet load time to ensure constraints are applied consistently.\" That commit is an ancestor of HEAD and the full post-fix state is present in the target. The vulnerable lazy-registration pattern is absent, so the target is not affected. The fix is upstream-authored (apache.org domain, not TuxCare/CloudLinux), so the verdict is not_affected (vendor-fix branch) with justification code_not_present, rather than already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target version 8.5.46 is not affected by CVE-2018-1336. The vulnerability affected Apache Tomcat versions 8.5.0 to 8.5.30. The upstream vendor fix (commit e00812b94e, authored by Mark Thomas markt@apache.org on 2018-04-27) was first included in version 8.5.31. The target version 8.5.46 inherits this fix from upstream, with the vulnerable pattern (missing input position rewind on UTF-8 decoder overflow) already removed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Target version 8.5.46 is not affected by CVE-2018-1336. The vulnerability affected Apache Tomcat versions 8.5.0 to 8.5.30. The upstream vendor fix (commit e00812b94e, authored by Mark Thomas markt@apache.org on 2018-04-27) was first included in version 8.5.31. The target version 8.5.46 inherits this fix from upstream, with the vulnerable pattern (missing input position rewind on UTF-8 decoder overflow) already removed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.46 is not affected by CVE-2018-8014. The upstream vendor (Apache) fixed this vulnerability on 2018-05-16 (commit 60f596a21f), over a year before the 8.5.46 release (2019-09-16). All three components of the fix are present: DEFAULT_ALLOWED_ORIGINS changed from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS changed from \"true\" to \"false\", and runtime validation preventing the insecure combination.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "Apache Tomcat 8.5.46 is not affected by CVE-2018-8014. The upstream vendor (Apache) fixed this vulnerability on 2018-05-16 (commit 60f596a21f), over a year before the 8.5.46 release (2019-09-16). All three components of the fix are present: DEFAULT_ALLOWED_ORIGINS changed from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS changed from \"true\" to \"false\", and runtime validation preventing the insecure combination."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.46 is NOT affected by CVE-2018-8034. The upstream vendor (Apache Tomcat) fixed this vulnerability in version 8.5.32 (first version after the affected range 8.5.0-8.5.31). The fix is present in the target code at WsWebSocketContainer.java:939-945, where setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification for TLS WebSocket connections. This is an upstream vendor fix authored by Mark Thomas from Apache, not a TuxCare backport. The vulnerable pattern (missing hostname verification) is not present in version 8.5.46.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "Apache Tomcat 8.5.46 is NOT affected by CVE-2018-8034. The upstream vendor (Apache Tomcat) fixed this vulnerability in version 8.5.32 (first version after the affected range 8.5.0-8.5.31). The fix is present in the target code at WsWebSocketContainer.java:939-945, where setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification for TLS WebSocket connections. This is an upstream vendor fix authored by Mark Thomas from Apache, not a TuxCare backport. The vulnerable pattern (missing hostname verification) is not present in version 8.5.46."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 is not present in Apache Tomcat 8.5.46. The vulnerability affects versions 8.5.5 to 8.5.31, and this target (8.5.46) already includes the complete upstream fix. The fix prevents race conditions in async request handling that could cause response data intended for one user to be delivered to another user. All fix commits were authored by upstream Apache developers (markt@apache.org...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 is not present in Apache Tomcat 8.5.46. The vulnerability affects versions 8.5.5 to 8.5.31, and this target (8.5.46) already includes the complete upstream fix. The fix prevents race conditions in async request handling that could cause response data intended for one user to be delivered to another user. All fix commits were authored by upstream Apache developers (markt@apache.org..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target version 8.5.46 is NOT AFFECTED by CVE-2019-0199. The vulnerability affected Tomcat 8.5.0 to 8.5.37. All required defenses (stream read/write timeouts and overhead frame tracking) are present in the target codebase. These fixes were authored by upstream (markt@apache.org) on Feb 1, 2019 and shipped with Apache Tomcat 8.5.38 (released Feb 21, 2019). Since 8.5.46 was released on Sep 19, 2019, it already included the upstream fixes at release time. The fixing commits are ancestors of the TuxCare onboarding commit (661a81e8 dated Oct 7, 2026), confirming they were part of the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "Target version 8.5.46 is NOT AFFECTED by CVE-2019-0199. The vulnerability affected Tomcat 8.5.0 to 8.5.37. All required defenses (stream read/write timeouts and overhead frame tracking) are present in the target codebase. These fixes were authored by upstream (markt@apache.org) on Feb 1, 2019 and shipped with Apache Tomcat 8.5.38 (released Feb 21, 2019). Since 8.5.46 was released on Sep 19, 2019, it already included the upstream fixes at release time. The fixing commits are ancestors of the TuxCare onboarding commit (661a81e8 dated Oct 7, 2026), confirming they were part of the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2019-0221. The XSS vulnerability in the SSI printenv command was fixed in upstream commit 4fcdf706f3 (by Mark Thomas on 2019-03-11) and was included in the Apache Tomcat 8.5.46 release (2019-09-19) before TuxCare onboarded the version. The target code at java/org/apache/catalina/ssi/SSIPrintenv.java:44 applies HTML entity encoding via getVariableValue...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2019-0221. The XSS vulnerability in the SSI printenv command was fixed in upstream commit 4fcdf706f3 (by Mark Thomas on 2019-03-11) and was included in the Apache Tomcat 8.5.46 release (2019-09-19) before TuxCare onboarded the version. The target code at java/org/apache/catalina/ssi/SSIPrintenv.java:44 applies HTML entity encoding via getVariableValue..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 is not present in Apache Tomcat 8.5.46. The fix for this Windows-specific command injection vulnerability in the CGI Servlet was already included in the upstream Apache Tomcat 8.5.46 release that TuxCare onboarded. The fix adds validation of decoded command line arguments (cmdLineArgumentsDecodedPattern) to prevent command injection when enableCmdLineArguments is enabled on Windows, restricting arguments to safe characters [a-zA-Z0-9-_.\\/:]+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 is not present in Apache Tomcat 8.5.46. The fix for this Windows-specific command injection vulnerability in the CGI Servlet was already included in the upstream Apache Tomcat 8.5.46 release that TuxCare onboarded. The fix adds validation of decoded command line arguments (cmdLineArgumentsDecodedPattern) to prevent command injection when enableCmdLineArguments is enabled on Windows, restricting arguments to safe characters [a-zA-Z0-9-_.\\/:]+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 affects Apache Tomcat 8.5.0 to 8.5.40, addressing HTTP/2 connection window exhaustion causing thread blocking and DoS. The target repository is Tomcat 8.5.46, which includes the upstream fix (commit 0bcd69c9dd) that was shipped in the Apache Tomcat 8.5.46 release. The fix adds bounded timeout handling to connection window allocation waits, preventing indefinite thread blocking. The vulnerable code pattern (indefinite wait without timeout) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "CVE-2019-10072 affects Apache Tomcat 8.5.0 to 8.5.40, addressing HTTP/2 connection window exhaustion causing thread blocking and DoS. The target repository is Tomcat 8.5.46, which includes the upstream fix (commit 0bcd69c9dd) that was shipped in the Apache Tomcat 8.5.46 release. The fix adds bounded timeout handling to connection window allocation waits, preventing indefinite thread blocking. The vulnerable code pattern (indefinite wait without timeout) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2019-12418"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2019-17563"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 8.5.46 is NOT affected by CVE-2019-17569. This CVE describes a regression introduced in versions 8.5.48-8.5.50 through a refactoring (bug 63864) that moved Transfer-Encoding parsing to use TokenList, which silently ignored invalid tokens. Version 8.5.46 predates this refactoring and uses different parsing code (Http11Processor.java) that properly validates Transfer-Encoding heade...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Target version 8.5.46 is NOT affected by CVE-2019-17569. This CVE describes a regression introduced in versions 8.5.48-8.5.50 through a refactoring (bug 63864) that moved Transfer-Encoding parsing to use TokenList, which silently ignored invalid tokens. Version 8.5.46 predates this refactoring and uses different parsing code (Http11Processor.java) that properly validates Transfer-Encoding heade..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2019-2684"
      },
      "impact_statement": "not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:56.665549+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2020-1938"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "action_statement": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2021-24122"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "action_statement": "Vulnerability CVE-2021-25329 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-28709"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "action_statement": "Vulnerability CVE-2023-34981 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:56.665549+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "action_statement": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "action_statement": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.46 is NOT AFFECTED by CVE-2024-52317. The vulnerability requires request/response object pooling with insufficient duplicate-call protection on the recycle() method, allowing the same objects to be returned to the pool multiple times and reused by different HTTP/2 streams. Version 8.5.46 completely lacks this pooling infrastructure: (1) No Stream.recycle() method exists, (2) N...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.46 is NOT AFFECTED by CVE-2024-52317. The vulnerability requires request/response object pooling with insufficient duplicate-call protection on the recycle() method, allowing the same objects to be returned to the pool multiple times and reused by different HTTP/2 streams. Version 8.5.46 completely lacks this pooling infrastructure: (1) No Stream.recycle() method exists, (2) N..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "action_statement": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "action_statement": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "action_statement": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-29129. The vulnerability was introduced when TLS 1.3 cipher suite configuration support was added in January 2026 (commit 4ee45c5571), which used HashSet instead of LinkedHashSet in getJsseCipherNames(), causing cipher order loss. Version 8.5.46 was released in September 2019 and does not have TLS 1.3 cipher suite configuration. It uses a simpler...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-29129. The vulnerability was introduced when TLS 1.3 cipher suite configuration support was added in January 2026 (commit 4ee45c5571), which used HashSet instead of LinkedHashSet in getJsseCipherNames(), causing cipher order loss. Version 8.5.46 was released in September 2019 and does not have TLS 1.3 cipher suite configuration. It uses a simpler..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CNA identifies incomplete escaping in JsonAccessLogValve and explicitly marks versions through 8.5.83 unaffected; its affected 8.5 range starts at 8.5.84 (CVE:1). HEAD contains no tracked JsonAccessLogValve or JSON access-log wrapper, and the configured logger is AccessLogValve using the common text pattern (server.xml:160). The shared URI/query append sites do exist, and the genuine fix\u2019s escaping calls are absent (AbstractAccessLogValve.java:1146, AbstractAccessLogValve.java:1350, AbstractAccessLogValve.java:1383, fix:19). Their actual consumer concatenates pattern elements and writes the resulting text followed by a newline, without the CVE\u2019s JSON wrapper (AbstractAccessLogValve.java:706, AccessLogValve.java:615).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CNA identifies incomplete escaping in JsonAccessLogValve and explicitly marks versions through 8.5.83 unaffected; its affected 8.5 range starts at 8.5.84 (CVE:1). HEAD contains no tracked JsonAccessLogValve or JSON access-log wrapper, and the configured logger is AccessLogValve using the common text pattern (server.xml:160). The shared URI/query append sites do exist, and the genuine fix\u2019s escaping calls are absent (AbstractAccessLogValve.java:1146, AbstractAccessLogValve.java:1350, AbstractAccessLogValve.java:1383, fix:19). Their actual consumer concatenates pattern elements and writes the resulting text followed by a newline, without the CVE\u2019s JSON wrapper (AbstractAccessLogValve.java:706, AccessLogValve.java:615)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.46 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.46 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.46 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.46 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:56:23.794214+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 8.5.46-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}