{
  "@id": "urn:uuid:be2ceb93-ec3b-4053-9aee-18d5c16e9390",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T11:20:14.777873+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:18:43.675482+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2008-1947. The XSS vulnerability in the host-manager application was fixed by upstream Apache in June 2008 (commit 78ad0fcbe2) by Mark Thomas. The fix added HTML escaping via RequestUtil.filter() (later refactored to Escape.htmlElementContent()) and URL encoding for the hostname parameter. This fix was already present in the upstream Apache Tomcat 8.5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2008-1947. The XSS vulnerability in the host-manager application was fixed by upstream Apache in June 2008 (commit 78ad0fcbe2) by Mark Thomas. The fix added HTML escaping via RequestUtil.filter() (later refactored to Escape.htmlElementContent()) and URL encoding for the hostname parameter. This fix was already present in the upstream Apache Tomcat 8.5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:07:58.117916+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS via Content-Length: 0 AJP requests that trigger thread hangs. The target version 8.5.78 already contains the upstream fix committed by Mark Thomas (markt@apache.org) on 2014-03-17 in commit 1bd7d41498. This fix was shipped in the upstream 8.5.78 release that TuxCare onboarded. The fix explicitly handles contentLength == 0 by sett...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS via Content-Length: 0 AJP requests that trigger thread hangs. The target version 8.5.78 already contains the upstream fix committed by Mark Thomas (markt@apache.org) on 2014-03-17 in commit 1bd7d41498. This fix was shipped in the upstream 8.5.78 release that TuxCare onboarded. The fix explicitly handles contentLength == 0 by sett..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affects Apache Tomcat 7.0.0-7.0.79 on Windows with PUT enabled, allowing JSP upload via specially crafted filenames with trailing spaces. The target (Tomcat 8.5.78) uses a different WebResourceSet architecture that includes the isInvalidWindowsFilename() validation, which rejects filenames ending with spaces on Windows. This fix (commit d5b170705d, Sept 2017) was authored by Apache upstream and shipped in the 8.5 release before TuxCare's onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affects Apache Tomcat 7.0.0-7.0.79 on Windows with PUT enabled, allowing JSP upload via specially crafted filenames with trailing spaces. The target (Tomcat 8.5.78) uses a different WebResourceSet architecture that includes the isInvalidWindowsFilename() validation, which rejects filenames ending with spaces on Windows. This fix (commit d5b170705d, Sept 2017) was authored by Apache upstream and shipped in the 8.5 release before TuxCare's onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 8.5.78 is NOT affected by CVE-2017-5651. The vulnerability (sendfile processor cache corruption leading to response mix-up) was fixed by upstream Apache developer Mark Thomas in commit 494429ca21 (bug 60918) dated March 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the TuxCare onboarding commit fb98844404 by 3599 commits. Code inspection confirms all fix elements are correctly implemented: SendfileState tracking variable, modified loop condition, processSendfile() method returning state, and removal of premature sendfileData clearing from prepareRequest().",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "The target Apache Tomcat 8.5.78 is NOT affected by CVE-2017-5651. The vulnerability (sendfile processor cache corruption leading to response mix-up) was fixed by upstream Apache developer Mark Thomas in commit 494429ca21 (bug 60918) dated March 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the TuxCare onboarding commit fb98844404 by 3599 commits. Code inspection confirms all fix elements are correctly implemented: SendfileState tracking variable, modified loop condition, processSendfile() method returning state, and removal of premature sendfileData clearing from prepareRequest()."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is NOT present in Apache Tomcat 8.5.78. The vulnerability allows attackers to craft URLs with multiple consecutive slashes to generate protocol-relative redirects (e.g., `//attacker.com`) that redirect users to malicious domains. The upstream fix (commit f9f147359b by Mark Thomas, Sep 4 2018) was already included in the Apache Tomcat 8.5.78 release that TuxCare onboarded. The fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 is NOT present in Apache Tomcat 8.5.78. The vulnerability allows attackers to craft URLs with multiple consecutive slashes to generate protocol-relative redirects (e.g., `//attacker.com`) that redirect users to malicious domains. The upstream fix (commit f9f147359b by Mark Thomas, Sep 4 2018) was already included in the Apache Tomcat 8.5.78 release that TuxCare onboarded. The fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 8.5.78 is not affected by CVE-2018-1304. The vulnerability was fixed in upstream Apache Tomcat 8.5.28 (February 2018) by commit 5af7c13cff, authored by Mark Thomas (markt@apache.org). This fix was already present when TuxCare onboarded version 8.5.78, as confirmed by the fix commit being an ancestor of the first TuxCare commit (fb98844404 \"Onboard version 8.5.78\"). The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 8.5.78 is not affected by CVE-2018-1304. The vulnerability was fixed in upstream Apache Tomcat 8.5.28 (February 2018) by commit 5af7c13cff, authored by Mark Thomas (markt@apache.org). This fix was already present when TuxCare onboarded version 8.5.78, as confirmed by the fix commit being an ancestor of the first TuxCare commit (fb98844404 \"Onboard version 8.5.78\"). The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.27. The target version 8.5.78 includes the upstream fix (commit 2349801827, Feb 2018) which moved ServletSecurity annotation processing from servlet load time to application startup, eliminating the race condition where security constraints could be bypassed based on servlet load order. The fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.27. The target version 8.5.78 includes the upstream fix (commit 2349801827, Feb 2018) which moved ServletSecurity annotation processing from servlet load time to application startup, eliminating the race condition where security constraints could be bypassed based on servlet load order. The fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 is NOT present in Tomcat 8.5.78. The vulnerability (improper overflow handling in UTF-8 decoder causing infinite loops with supplementary characters) was fixed by upstream Apache Tomcat commit e00812b94e on 2018-04-27. This fix was already included in the upstream 8.5.78 release that TuxCare onboarded. The defense code is present at Utf8Decoder.java:280-286, which rewinds input position by 3 bytes before signaling OVERFLOW when decoding 4-byte UTF-8 sequences, preventing the infinite loop that would occur without proper position management.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 is NOT present in Tomcat 8.5.78. The vulnerability (improper overflow handling in UTF-8 decoder causing infinite loops with supplementary characters) was fixed by upstream Apache Tomcat commit e00812b94e on 2018-04-27. This fix was already included in the upstream 8.5.78 release that TuxCare onboarded. The defense code is present at Utf8Decoder.java:280-286, which rewinds input position by 3 bytes before signaling OVERFLOW when decoding 4-byte UTF-8 sequences, preventing the infinite loop that would occur without proper position management."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 is not present in Apache Tomcat 8.5.78. The vulnerability affected Tomcat 8.5.0 to 8.5.31 with insecure CORS filter defaults (supportsCredentials=true for all origins). The upstream fix was applied in version 8.5.32 (May 2018) by commit 60f596a21f, authored by Mark Thomas (markt@apache.org). Version 8.5.78 includes this fix: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing supportsCredentials=true with allowedOrigins=*, and simplified logic in addStandardHeaders. The vulnerable pattern is absent because the fix shipped in the upstream release before TuxCare onboarded this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 is not present in Apache Tomcat 8.5.78. The vulnerability affected Tomcat 8.5.0 to 8.5.31 with insecure CORS filter defaults (supportsCredentials=true for all origins). The upstream fix was applied in version 8.5.32 (May 2018) by commit 60f596a21f, authored by Mark Thomas (markt@apache.org). Version 8.5.78 includes this fix: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing supportsCredentials=true with allowedOrigins=*, and simplified logic in addStandardHeaders. The vulnerable pattern is absent because the fix shipped in the upstream release before TuxCare onboarded this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 (missing hostname verification in WebSocket TLS connections) is NOT present in Apache Tomcat 8.5.78. The vulnerability was fixed by upstream developer Mark Thomas in commit f6bf951acb (June 2018), which added mandatory hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was already present in the upstream Apache Tomcat 8.5.78 release (2022) before TuxCare onboarded it in September 2026. The target code at WsWebSocketContainer.java:950-956 unconditionally applies hostname verification to all WebSocket TLS connections with no bypass paths.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 (missing hostname verification in WebSocket TLS connections) is NOT present in Apache Tomcat 8.5.78. The vulnerability was fixed by upstream developer Mark Thomas in commit f6bf951acb (June 2018), which added mandatory hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was already present in the upstream Apache Tomcat 8.5.78 release (2022) before TuxCare onboarded it in September 2026. The target code at WsWebSocketContainer.java:950-956 unconditionally applies hostname verification to all WebSocket TLS connections with no bypass paths."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:23:00.136176+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 is NOT present in Tomcat 8.5.78. The vulnerability was fixed by Apache upstream in June 2018 and shipped in the 8.5.78 release that TuxCare onboarded. The fix introduces a generation counter mechanism that prevents stale async timeout events from being processed, eliminating the race condition that could cause response mix-up between users. All fix components are present and funct...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 is NOT present in Tomcat 8.5.78. The vulnerability was fixed by Apache upstream in June 2018 and shipped in the 8.5.78 release that TuxCare onboarded. The fix introduces a generation counter mechanism that prevents stale async timeout events from being processed, eliminating the race condition that could cause response mix-up between users. All fix components are present and funct..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 affects Apache Tomcat 8.5.0 to 8.5.37. The target is version 8.5.78-tuxcare.3, which is based on upstream 8.5.78 released after the affected range. The vulnerability (DoS via excessive HTTP/2 SETTINGS frames and indefinite stream blocking) was fixed by upstream Apache in commits 2c5939e1, 69c57c8c, 19bebdec, and 65f4b6d1 authored by Mark Thomas. All four fixes are present in the target: stream-level read/write timeouts (DEFAULT_STREAM_READ_TIMEOUT=20000ms, DEFAULT_STREAM_WRITE_TIMEOUT=20000ms in Http2Protocol.java), timeout enforcement in Stream.java (lines 1063-1075 for read, 215-220 for write), and overhead frame counting in Http2UpgradeHandler.java (lines 157, 358, 1761, 1854, 1903). These fixes shipped in the upstream 8.5.78 release that TuxCare onboarded (commit fb98844404 by amoniatovskiy@cloudlinux.com). The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 affects Apache Tomcat 8.5.0 to 8.5.37. The target is version 8.5.78-tuxcare.3, which is based on upstream 8.5.78 released after the affected range. The vulnerability (DoS via excessive HTTP/2 SETTINGS frames and indefinite stream blocking) was fixed by upstream Apache in commits 2c5939e1, 69c57c8c, 19bebdec, and 65f4b6d1 authored by Mark Thomas. All four fixes are present in the target: stream-level read/write timeouts (DEFAULT_STREAM_READ_TIMEOUT=20000ms, DEFAULT_STREAM_WRITE_TIMEOUT=20000ms in Http2Protocol.java), timeout enforcement in Stream.java (lines 1063-1075 for read, 215-220 for write), and overhead frame counting in Http2UpgradeHandler.java (lines 157, 358, 1761, 1854, 1903). These fixes shipped in the upstream 8.5.78 release that TuxCare onboarded (commit fb98844404 by amoniatovskiy@cloudlinux.com). The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoed user-provided data without HTML entity encoding, enabling XSS attacks. The target Apache Tomcat 8.5.78 contains the upstream fix from commit 4fcdf706f3 (March 11, 2019) which adds HTML entity encoding via the ENCODING_ENTITY parameter to getVariableValue() calls. This fix applies Escape.htmlElementContent() to escape special characters...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoed user-provided data without HTML entity encoding, enabling XSS attacks. The target Apache Tomcat 8.5.78 contains the upstream fix from commit 4fcdf706f3 (March 11, 2019) which adds HTML entity encoding via the ENCODING_ENTITY parameter to getVariableValue() calls. This fix applies Escape.htmlElementContent() to escape special characters..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 is a Windows-specific command injection vulnerability in Tomcat's CGI Servlet when enableCmdLineArguments is enabled. The CVE explicitly states affected versions are \"8.5.0 to 8.5.39\". The target version 8.5.78 already includes the upstream fix (released in Tomcat 8.5.40, April 2019) that validates decoded command-line arguments against a whitelist pattern before spawning CGI processes. The vulnerable code pattern was never present in 8.5.78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 is a Windows-specific command injection vulnerability in Tomcat's CGI Servlet when enableCmdLineArguments is enabled. The CVE explicitly states affected versions are \"8.5.0 to 8.5.39\". The target version 8.5.78 already includes the upstream fix (released in Tomcat 8.5.40, April 2019) that validates decoded command-line arguments against a whitelist pattern before spawning CGI processes. The vulnerable code pattern was never present in 8.5.78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 is NOT present in Apache Tomcat 8.5.78-tuxcare.3. The vulnerability affected Tomcat 8.5.0 to 8.5.40 due to missing timeout handling when the HTTP/2 connection window is exhausted. The fix was introduced by upstream Apache Tomcat in version 8.5.41 (commit 0bcd69c9, 2019-04-30) and was already present in the 8.5.78 release that TuxCare onboarded. The target contains the complete defense: timeout-based waiting for connection window allocation with connection closure on timeout expiration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "CVE-2019-10072 is NOT present in Apache Tomcat 8.5.78-tuxcare.3. The vulnerability affected Tomcat 8.5.0 to 8.5.40 due to missing timeout handling when the HTTP/2 connection window is exhausted. The fix was introduced by upstream Apache Tomcat in version 8.5.41 (commit 0bcd69c9, 2019-04-30) and was already present in the 8.5.78 release that TuxCare onboarded. The target contains the complete defense: timeout-based waiting for connection window allocation with connection closure on timeout expiration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target version 8.5.78 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was completely removed by upstream Apache Tomcat before the 8.5.78 release. The removal commit (1b9e8fd1f4 by Mark Thomas) deleted the entire class and its 551 lines of code, including the vulnerable RMI registry creation logic. Since the JmxRemoteLifecycleListener no longer exists in the target, the vulnerability cannot be exploited. This is an upstream fix that shipped in the 8.5.78 release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "Target version 8.5.78 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was completely removed by upstream Apache Tomcat before the 8.5.78 release. The removal commit (1b9e8fd1f4 by Mark Thomas) deleted the entire class and its 551 lines of code, including the vulnerable RMI registry creation logic. Since the JmxRemoteLifecycleListener no longer exists in the target, the vulnerability cannot be exploited. This is an upstream fix that shipped in the 8.5.78 release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 describes a session fixation vulnerability in Apache Tomcat's FORM authentication mechanism. The target is Apache Tomcat 8.5.78. The CVE affected versions 8.5.0 to 8.5.49; fixes were released in 8.5.50. Since 8.5.78 > 8.5.50, the upstream release already contains the complete fix. Analysis confirmed both required upstream fix commits (e19a202ee4 \"Refactor so Principal is never cached in session with cache==false\" and e8ae801192 \"Harden the FORM authentication process\", both by markt@apache.org on 2019-12-05) are ancestors of the onboarding commit fb98844404 and shipped in upstream 8.5.78. The target code exhibits fixed behavior: checkForCachedAuthentication called after matching request check (FormAuthenticator.java:186-190), SESSION_ID_NOTE tracking implemented (Constants.java:64, FormAuthenticator.java:259,422,521,553, AuthenticatorBase.java:1155-1156), and session ID changed on authentication (AuthenticatorBase.java:1152-1153). No TuxCare backport was needed. Verdict: not_affected, justification: code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 describes a session fixation vulnerability in Apache Tomcat's FORM authentication mechanism. The target is Apache Tomcat 8.5.78. The CVE affected versions 8.5.0 to 8.5.49; fixes were released in 8.5.50. Since 8.5.78 > 8.5.50, the upstream release already contains the complete fix. Analysis confirmed both required upstream fix commits (e19a202ee4 \"Refactor so Principal is never cached in session with cache==false\" and e8ae801192 \"Harden the FORM authentication process\", both by markt@apache.org on 2019-12-05) are ancestors of the onboarding commit fb98844404 and shipped in upstream 8.5.78. The target code exhibits fixed behavior: checkForCachedAuthentication called after matching request check (FormAuthenticator.java:186-190), SESSION_ID_NOTE tracking implemented (Constants.java:64, FormAuthenticator.java:259,422,521,553, AuthenticatorBase.java:1155-1156), and session ID changed on authentication (AuthenticatorBase.java:1152-1153). No TuxCare backport was needed. Verdict: not_affected, justification: code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:28:12.870489+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2019-17569. The vulnerability was a regression introduced in versions 8.5.48-8.5.50 where invalid Transfer-Encoding headers were silently ignored instead of rejected, potentially enabling HTTP Request Smuggling. The fix (proper validation and rejection with HTTP 400 error) was implemented by Apache upstream in December 2019 and was already present in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2019-17569. The vulnerability was a regression introduced in versions 8.5.48-8.5.50 where invalid Transfer-Encoding headers were silently ignored instead of rejected, potentially enabling HTTP Request Smuggling. The fix (proper validation and rejection with HTTP 400 error) was implemented by Apache upstream in December 2019 and was already present in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-1935. The vulnerability was fixed by Apache upstream in version 8.5.51 (January 2020) through stricter HTTP header parsing. The target contains the vendor's final fix strategy: (1) rejection of bare CR (carriage return not followed by line feed), (2) rejection of control characters in header values (except TAB), and (3) acceptance of bare LF as a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-1935. The vulnerability was fixed by Apache upstream in version 8.5.51 (January 2020) through stricter HTTP header parsing. The target contains the vendor's final fix strategy: (1) rejection of bare CR (carriage return not followed by line feed), (2) rejection of control characters in header values (except TAB), and (3) acceptance of bare LF as a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Apache Tomcat 8.5.78-tuxcare.3. All required fixes were shipped in upstream Apache Tomcat 8.5.51 (released January 2020) and are present in the target's 8.5.78 base release. The fixes include: (1) request attribute name validation with whitelist blocking dangerous javax.servlet.include.* attributes, (2) default AJP bind to loopback address, and (3) mandatory secret validation. Fix commits by Mark Thomas (markt@apache.org) are ancestors of the TuxCare onboarding commit, confirming upstream attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Apache Tomcat 8.5.78-tuxcare.3. All required fixes were shipped in upstream Apache Tomcat 8.5.51 (released January 2020) and are present in the target's 8.5.78 base release. The fixes include: (1) request attribute name validation with whitelist blocking dangerous javax.servlet.include.* attributes, (2) default AJP bind to loopback address, and (3) mandatory secret validation. Fix commits by Mark Thomas (markt@apache.org) are ancestors of the TuxCare onboarding commit, confirming upstream attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 affects Apache Tomcat 8.5.0 to 8.5.59. The target is version 8.5.78, which already contains the upstream fix (commit 920dddbdb9 from 2020-11-06) that rejects colon ':' characters in Windows filenames. The fix was shipped in the upstream release before TuxCare onboarded version 8.5.78 on 2022-03-31. The vulnerable code pattern (missing ':' in isInvalidWindowsFilename check) is not...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 affects Apache Tomcat 8.5.0 to 8.5.59. The target is version 8.5.78, which already contains the upstream fix (commit 920dddbdb9 from 2020-11-06) that rejects colon ':' characters in Windows filenames. The fix was shipped in the upstream release before TuxCare onboarded version 8.5.78 on 2022-03-31. The vulnerable code pattern (missing ':' in isInvalidWindowsFilename check) is not..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 8.5.78 is not affected by CVE-2021-25122. The vulnerability affected versions 8.5.0 to 8.5.61, and all required fixes for bug 64830 are present in the target code. The fixes were authored by upstream Apache (Mark Thomas) and shipped with the 8.5.78 release that TuxCare onboarded. The vulnerable patterns (shared StringBuilder in HpackDecoder, non-thread-safe EnumMap in ConnectionSettingsBase, and improper processor lifecycle management) are not present in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "The target Apache Tomcat 8.5.78 is not affected by CVE-2021-25122. The vulnerability affected versions 8.5.0 to 8.5.61, and all required fixes for bug 64830 are present in the target code. The fixes were authored by upstream Apache (Mark Thomas) and shipped with the 8.5.78 release that TuxCare onboarded. The vulnerable patterns (shared StringBuilder in HpackDecoder, non-thread-safe EnumMap in ConnectionSettingsBase, and improper processor lifecycle management) are not present in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 does not affect Tomcat 8.5.78. The vulnerability involved string-based path validation that could be bypassed via directory name prefix attacks (e.g., /var/app vs /var/app-evil). Apache upstream fixed this in version 8.5.62 (released 2021-01-20) by replacing String.startsWith() checks with java.nio.file.Path.startsWith() hierarchy validation. The target version 8.5.78 inherited this fix from the upstream release. All five affected files (DefaultServlet.java, FileStore.java, ContextConfig.java, ExpandWar.java, HostConfig.java) contain the fixed code using .toPath().startsWith() path validation. No TuxCare backport of CVE-2021-25329 exists on the 8.5.78 branch because the upstream release already included the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 does not affect Tomcat 8.5.78. The vulnerability involved string-based path validation that could be bypassed via directory name prefix attacks (e.g., /var/app vs /var/app-evil). Apache upstream fixed this in version 8.5.62 (released 2021-01-20) by replacing String.startsWith() checks with java.nio.file.Path.startsWith() hierarchy validation. The target version 8.5.78 inherited this fix from the upstream release. All five affected files (DefaultServlet.java, FileStore.java, ContextConfig.java, ExpandWar.java, HostConfig.java) contain the fixed code using .toPath().startsWith() path validation. No TuxCare backport of CVE-2021-25329 exists on the 8.5.78 branch because the upstream release already included the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:11:34.688190+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T07:21:00.053254+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "action_statement": "Vulnerability CVE-2023-28709 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "action_statement": "Vulnerability CVE-2023-34981 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T11:20:14.777873+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "action_statement": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "action_statement": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:43:00.122669+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7 through 8.5.63. The target is version 8.5.78, which already contains the upstream fix introduced in version 8.5.64. The vulnerability involved generating error messages containing sensitive internal server state when attempting I/O operations on closed connections. The fix (commit 0ff1ed325d2) adds IS_IO_ALLOWED checks in ErrorReportValve.java to preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7 through 8.5.63. The target is version 8.5.78, which already contains the upstream fix introduced in version 8.5.64. The vulnerability involved generating error messages containing sensitive internal server state when attempting I/O operations on closed connections. The fix (commit 0ff1ed325d2) adds IS_IO_ALLOWED checks in ErrorReportValve.java to preve..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:45.693342+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "action_statement": "Vulnerability CVE-2024-38286 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:35:21.882986+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.78 is NOT affected by CVE-2024-52317. While the target version has HTTP/2 support and the Stream.recycle() method that could be called multiple times during error conditions, it lacks the request/response pooling mechanism that enables the vulnerability. In version 8.5.78, each Stream creates its own dedicated Request and Response objects (as final fields) that are never poole...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.78 is NOT affected by CVE-2024-52317. While the target version has HTTP/2 support and the Stream.recycle() method that could be called multiple times during error conditions, it lacks the request/response pooling mechanism that enables the vulnerability. In version 8.5.78, each Stream creates its own dedicated Request and Response objects (as final fields) that are never poole..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "action_statement": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "action_statement": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "action_statement": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "action_statement": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "action_statement": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:45.693342+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "action_statement": "Vulnerability CVE-2025-52434 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 8.5.78-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "action_statement": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      },
      "action_statement": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "action_statement": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-29129. The vulnerability was introduced in later versions (9.0.114+, 10.1.51+, 11.0.16+) when TLS 1.3 cipher suite support was added. Version 8.5.78 lacks the TLS 1.3 cipher suite merging code that used HashSet instead of LinkedHashSet, causing cipher order to not be preserved. The target version uses a simpler code path that already preserves ci...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-29129. The vulnerability was introduced in later versions (9.0.114+, 10.1.51+, 11.0.16+) when TLS 1.3 cipher suite support was added. Version 8.5.78 lacks the TLS 1.3 cipher suite merging code that used HashSet instead of LinkedHashSet, causing cipher order to not be preserved. The target version uses a simpler code path that already preserves ci..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:24:00.046712+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:20:00.095414+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 8.5.78-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}