{ "@id": "urn:uuid:3435a66f-5709-42b1-a85d-2c10d8afea08", "role": "Document Creator", "author": "https://tuxcare.com", "version": 41, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:13:00.045658+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-03T16:18:43.675482+00:00", "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability affecting Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16. The target version 9.0.24 (released August 2019) is not affected. The vulnerable code pattern (unescaped hostname rendering) is not present. The current code comprehensively escapes HTML via Escape.htmlElementContent() at all display points (lines 285, 343, 357 of HTMLHostManagerServlet.java) and URL-en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-1947" }, "impact_statement": "not_affected \u2014 CVE-2008-1947 is an XSS vulnerability affecting Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16. The target version 9.0.24 (released August 2019) is not affected. The vulnerable code pattern (unescaped hostname rendering) is not present. The current code comprehensively escapes HTML via Escape.htmlElementContent() at all display points (lines 285, 343, 357 of HTMLHostManagerServlet.java) and URL-en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-03T16:07:58.117916+00:00", "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 is not present in Apache Tomcat 9.0.24. The vulnerability affected Tomcat 8.x before 8.0.4, where Content-Length: 0 AJP requests caused thread hangs. The fix was applied by Mark Thomas (markt@apache.org) on March 17, 2014 in commit 8884dae60a, and was included in the upstream Tomcat 9.0.24 release. The current code properly handles Content-Length: 0 by setting endOfStream=true and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0095" }, "impact_statement": "not_affected \u2014 CVE-2014-0095 is not present in Apache Tomcat 9.0.24. The vulnerability affected Tomcat 8.x before 8.0.4, where Content-Length: 0 AJP requests caused thread hangs. The fix was applied by Mark Thomas (markt@apache.org) on March 17, 2014 in commit 8884dae60a, and was included in the upstream Tomcat 9.0.24 release. The current code properly handles Content-Length: 0 by setting endOfStream=true and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.24 is not affected by CVE-2017-12615. The vulnerability targeted Tomcat 7.x's FileDirContext class, which doesn't exist in Tomcat 9.x. Tomcat 9.x uses a completely different architecture (WebResourceRoot/AbstractFileResourceSet) that includes protection against the trailing dot filename attack. The fix was part of the upstream 9.0.0 release (September 2017) and is therefore present in 9.0.24 (August 2019).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12615" }, "impact_statement": "Tomcat 9.0.24 is not affected by CVE-2017-12615. The vulnerability targeted Tomcat 7.x's FileDirContext class, which doesn't exist in Tomcat 9.x. Tomcat 9.x uses a completely different architecture (WebResourceRoot/AbstractFileResourceSet) that includes protection against the trailing dot filename attack. The fix was part of the upstream 9.0.0 release (September 2017) and is therefore present in 9.0.24 (August 2019).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is not present in Apache Tomcat 9.0.24. The vulnerability allowed uploading JSP files via HTTP PUT with paths ending in '/', exploiting a discrepancy between Java's File API (which matches files ignoring trailing slashes) and servlet spec path mapping rules (which treat trailing slashes as directories). The comprehensive fix was authored by Apache upstream developer Mark Thomas (markt@apache.org) and was already present in the 9.0.24 release that TuxCare onboarded. The fix prevents both file creation and file lookup operations when paths end with '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12617" }, "impact_statement": "CVE-2017-12617 is not present in Apache Tomcat 9.0.24. The vulnerability allowed uploading JSP files via HTTP PUT with paths ending in '/', exploiting a discrepancy between Java's File API (which matches files ignoring trailing slashes) and servlet spec path mapping rules (which treat trailing slashes as directories). The comprehensive fix was authored by Apache upstream developer Mark Thomas (markt@apache.org) and was already present in the 9.0.24 release that TuxCare onboarded. The fix prevents both file creation and file lookup operations when paths end with '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.24. The vulnerability involved passing Tomcat's internal Request/Response objects (instead of facade objects) to application listener events (fireRequestInitEvent/fireRequestDestroyEvent), allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The upstream fix by Mark Thomas (March 2017) changed all vulnerable call sites to use request.getRequest() before passing to listeners. This fix was already included in Apache Tomcat 9.0.24 (released July 2019) when TuxCare onboarded it. All three affected files (FormAuthenticator, AsyncContextImpl, StandardHostValve) use the corrected facade pattern in the target code at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5648" }, "impact_statement": "CVE-2017-5648 is NOT present in Apache Tomcat 9.0.24. The vulnerability involved passing Tomcat's internal Request/Response objects (instead of facade objects) to application listener events (fireRequestInitEvent/fireRequestDestroyEvent), allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The upstream fix by Mark Thomas (March 2017) changed all vulnerable call sites to use request.getRequest() before passing to listeners. This fix was already included in Apache Tomcat 9.0.24 (released July 2019) when TuxCare onboarded it. All three affected files (FormAuthenticator, AsyncContextImpl, StandardHostValve) use the corrected facade pattern in the target code at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M18. The target version 9.0.24 (released August 2019) is not affected because the upstream vendor (Apache) fixed this vulnerability in March 2017 (bug 60918) before releasing 9.0.24. All fix components are present in the target code: SendfileState tracking, modified keep-alive loop condition, processSendfile() method, and removed sendfileData clearing in prepareRequest(). The fix was already present in the upstream 9.0.24 release when TuxCare onboarded it via commit 9c7e71d9ac.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5651" }, "impact_statement": "CVE-2017-5651 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M18. The target version 9.0.24 (released August 2019) is not affected because the upstream vendor (Apache) fixed this vulnerability in March 2017 (bug 60918) before releasing 9.0.24. All fix components are present in the target code: SendfileState tracking, modified keep-alive loop condition, processSendfile() method, and removed sendfileData clearing in prepareRequest(). The fix was already present in the upstream 9.0.24 release when TuxCare onboarded it via commit 9c7e71d9ac.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 9.0.24 is NOT AFFECTED by CVE-2018-11784. The upstream fix from Apache Tomcat commit efb860b3ff8ebcf606199b8d0d432f76898040da (authored by Mark Thomas on Sep 4, 2018) was already included in the upstream 9.0.24 release when TuxCare onboarded it. The fix prevents protocol-relative redirect attacks by stripping consecutive leading slashes from redirect ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11784" }, "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.24 is NOT AFFECTED by CVE-2018-11784. The upstream fix from Apache Tomcat commit efb860b3ff8ebcf606199b8d0d432f76898040da (authored by Mark Thomas on Sep 4, 2018) was already included in the upstream 9.0.24 release when TuxCare onboarded it. The fix prevents protocol-relative redirect attacks by stripping consecutive leading slashes from redirect ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-02T14:35:22.251531+00:00", "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is NOT present in Tomcat 9.0.24. The vulnerability affected versions 9.0.0.M1 to 9.0.4, and the fix was applied by Apache upstream on Feb 6, 2018 (commit 723ea6a5bc) by Mark Thomas. This fix was already included in the upstream Tomcat 9.0.24 release when TuxCare onboarded it. Both required fix components are present: (1) empty string URI normalization to \"/\" at line 555, and (2) e...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1304" }, "impact_statement": "not_affected \u2014 CVE-2018-1304 is NOT present in Tomcat 9.0.24. The vulnerability affected versions 9.0.0.M1 to 9.0.4, and the fix was applied by Apache upstream on Feb 6, 2018 (commit 723ea6a5bc) by Mark Thomas. This fix was already included in the upstream Tomcat 9.0.24 release when TuxCare onboarded it. Both required fix components are present: (1) empty string URI normalization to \"/\" at line 555, and (2) e..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in target version 9.0.24. The upstream fix (commit 3e54b2a6314e by markt@apache.org, dated 2018-02-06) was included in Apache Tomcat 9.0.10 and all subsequent releases including 9.0.24. The vulnerable pattern\u2014lazy processing of @ServletSecurity annotations at servlet load time\u2014has been completely removed and replaced with eager processing at application startup. All...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1305" }, "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in target version 9.0.24. The upstream fix (commit 3e54b2a6314e by markt@apache.org, dated 2018-02-06) was included in Apache Tomcat 9.0.10 and all subsequent releases including 9.0.24. The vulnerable pattern\u2014lazy processing of @ServletSecurity annotations at servlet load time\u2014has been completely removed and replaced with eager processing at application startup. All..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 is NOT present in Tomcat 9.0.24. The vulnerability (infinite loop in UTF-8 decoder with supplementary characters) was fixed by upstream Apache Tomcat developer Mark Thomas in commit 92cd494555 on April 27, 2018. This fix was already included in the upstream Tomcat 9.0.24 release that TuxCare later onboarded on October 7, 2026. The defensive code that prevents the infinite loop is present at lines 280-286 of Utf8Decoder.java, which rewinds the input position by 3 bytes before returning overflow status when insufficient output buffer space exists for a supplementary character.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1336" }, "impact_statement": "CVE-2018-1336 is NOT present in Tomcat 9.0.24. The vulnerability (infinite loop in UTF-8 decoder with supplementary characters) was fixed by upstream Apache Tomcat developer Mark Thomas in commit 92cd494555 on April 27, 2018. This fix was already included in the upstream Tomcat 9.0.24 release that TuxCare later onboarded on October 7, 2026. The defensive code that prevents the infinite loop is present at lines 280-286 of Utf8Decoder.java, which rewinds the input position by 3 bytes before returning overflow status when insufficient output buffer space exists for a supplementary character.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 9.0.24 is not affected by CVE-2018-8014. The vulnerability concerned insecure default CORS filter settings (DEFAULT_ALLOWED_ORIGINS=\"*\" with DEFAULT_SUPPORTS_CREDENTIALS=\"true\"), which allowed credentialed cross-origin requests from any origin. The upstream fix (commit d83a76732e by Mark Thomas, dated 2018-05-16) was already present in the upstream release 9.0.24 before TuxCare onboarded it (2026-10-07). All fix components are present: DEFAULT_ALLOWED_ORIGINS=\"\" (line 1086), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (line 1102), validation preventing the insecure combination (line 758-760), and simplified response header logic (line 411). CVE affected versions 9.0.0.M1 to 9.0.8; version 9.0.24 is well beyond that range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8014" }, "impact_statement": "The target Tomcat 9.0.24 is not affected by CVE-2018-8014. The vulnerability concerned insecure default CORS filter settings (DEFAULT_ALLOWED_ORIGINS=\"*\" with DEFAULT_SUPPORTS_CREDENTIALS=\"true\"), which allowed credentialed cross-origin requests from any origin. The upstream fix (commit d83a76732e by Mark Thomas, dated 2018-05-16) was already present in the upstream release 9.0.24 before TuxCare onboarded it (2026-10-07). All fix components are present: DEFAULT_ALLOWED_ORIGINS=\"\" (line 1086), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (line 1102), validation preventing the insecure combination (line 758-760), and simplified response header logic (line 411). CVE affected versions 9.0.0.M1 to 9.0.8; version 9.0.24 is well beyond that range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target version 9.0.24 is not affected by CVE-2018-8034. The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.9, but the fix was applied upstream in June 2018 (commit 2835bb4e) and was included in version 9.0.10 and later. The target's 9.0.24 release already contains the upstream fix that enables hostname verification for TLS WebSocket client connections via SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8034" }, "impact_statement": "Target version 9.0.24 is not affected by CVE-2018-8034. The vulnerability affects Apache Tomcat versions 9.0.0.M1 to 9.0.9, but the fix was applied upstream in June 2018 (commit 2835bb4e) and was included in version 9.0.10 and later. The target's 9.0.24 release already contains the upstream fix that enables hostname verification for TLS WebSocket client connections via SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-03T01:24:00.112315+00:00", "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 fixes were already present in the upstream Apache Tomcat 9.0.24 release. The vulnerability affected versions 9.0.0.M9 to 9.0.9, and the fixes were committed in June 2018 (generation counter mechanism) and refined through May 2019 (connection closure tracking refactor), all before the 9.0.24 release. Both defense mechanisms are present and functional in the target: (1) generation c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8037" }, "impact_statement": "not_affected \u2014 CVE-2018-8037 fixes were already present in the upstream Apache Tomcat 9.0.24 release. The vulnerability affected versions 9.0.0.M9 to 9.0.9, and the fixes were committed in June 2018 (generation counter mechanism) and refined through May 2019 (connection closure tracking refactor), all before the 9.0.24 release. Both defense mechanisms are present and functional in the target: (1) generation c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.24 is not affected by CVE-2019-0199. The vulnerability affected versions 9.0.0.M1 to 9.0.14, and all fixes (stream timeouts and overhead frame counting) were applied to the upstream Apache Tomcat codebase on February 1, 2019, before the 9.0.24 release on August 14, 2019. The target version ships with these protections enabled by default: stream read/write timeouts of 20 seconds and active overhead counting with factor 1. The vulnerable pattern (indefinite wait() calls without timeouts and absent overhead tracking) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0199" }, "impact_statement": "Apache Tomcat 9.0.24 is not affected by CVE-2019-0199. The vulnerability affected versions 9.0.0.M1 to 9.0.14, and all fixes (stream timeouts and overhead frame counting) were applied to the upstream Apache Tomcat codebase on February 1, 2019, before the 9.0.24 release on August 14, 2019. The target version ships with these protections enabled by default: stream read/write timeouts of 20 seconds and active overhead counting with factor 1. The vulnerable pattern (indefinite wait() calls without timeouts and absent overhead tracking) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat's SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Tomcat 9.0.24 is NOT affected because the upstream fix (commit 15fcd166ea by markt@apache.org, applied 2019-03-11) was already included in the 9.0.24 release before TuxCare onboarded it. The fix applies HTML entity encoding to variable values via SSIMediator.EN...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0221" }, "impact_statement": "not_affected \u2014 CVE-2019-0221 affects Apache Tomcat's SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Tomcat 9.0.24 is NOT affected because the upstream fix (commit 15fcd166ea by markt@apache.org, applied 2019-03-11) was already included in the 9.0.24 release before TuxCare onboarded it. The fix applies HTML entity encoding to variable values via SSIMediator.EN..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 9.0.24 is not affected by CVE-2019-0232. The vulnerability affects versions 9.0.0.M1 to 9.0.17, and the fix was already present in the upstream 9.0.24 release that TuxCare onboarded. The fix adds validation of decoded CGI command line arguments to prevent Windows command injection. Additionally, the vulnerable feature (enableCmdLineArguments) is disabled by default, providing defense in depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0232" }, "impact_statement": "The target Apache Tomcat 9.0.24 is not affected by CVE-2019-0232. The vulnerability affects versions 9.0.0.M1 to 9.0.17, and the fix was already present in the upstream 9.0.24 release that TuxCare onboarded. The fix adds validation of decoded CGI command line arguments to prevent Windows command injection. Additionally, the vulnerable feature (enableCmdLineArguments) is disabled by default, providing defense in depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 is NOT present in Tomcat 9.0.24. The vulnerability affected versions 9.0.0.M1 to 9.0.19, but the fix was already included in the upstream Tomcat 9.0.24 release that TuxCare onboarded. The vulnerable code pattern (indefinite blocking when connection window is exhausted) has been replaced with timeout-enforced waiting that closes the connection after timeout expiration without allocation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10072" }, "impact_statement": "CVE-2019-10072 is NOT present in Tomcat 9.0.24. The vulnerability affected versions 9.0.0.M1 to 9.0.19, but the fix was already included in the upstream Tomcat 9.0.24 release that TuxCare onboarded. The vulnerable code pattern (indefinite blocking when connection window is exhausted) has been replaced with timeout-enforced waiting that closes the connection after timeout expiration without allocation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2019-12418 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-12418" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2019-17563 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-17563" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-03T16:24:56.766712+00:00", "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2019-17569. This CVE describes a regression introduced by refactoring in versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99. Since version 9.0.24 predates the vulnerable refactoring (9.0.24 < 9.0.28), it does not contain the broken Transfer-Encoding validation code. The code inspection confirms that proper validation logic is present in 9.0.24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17569" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2019-17569. This CVE describes a regression introduced by refactoring in versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99. Since version 9.0.24 predates the vulnerable refactoring (9.0.24 < 9.0.28), it does not contain the broken Transfer-Encoding validation code. The code inspection confirms that proper validation logic is present in 9.0.24." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2020-1938 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-1938" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2020-9484 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-9484" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2021-24122 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-24122" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2021-25329 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-25329" }, "action_statement": "Vulnerability CVE-2021-25329 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-24998" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T01:46:20.750358+00:00", "status_notes": "Vulnerability CVE-2023-28709 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-28709" }, "action_statement": "Vulnerability CVE-2023-28709 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2023-34981 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-34981" }, "action_statement": "Vulnerability CVE-2023-34981 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-41080" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-42795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-44487" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-45648" }, "action_statement": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-24549" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2024-50379 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-50379" }, "action_statement": "Vulnerability CVE-2024-50379 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-03T16:34:22.136729+00:00", "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2024-52317. The vulnerable HTTP/2 request/response recycling mechanism does not exist in this version. The recycling feature was introduced in version 9.0.92 (commit 3c5b14b713, July 24, 2024), and the CVE explicitly states it affects versions 9.0.92-9.0.95. Since 9.0.24 predates the introduction of this feature by 68 versions, the vulnerability canno...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52317" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2024-52317. The vulnerable HTTP/2 request/response recycling mechanism does not exist in this version. The recycling feature was introduced in version 9.0.92 (commit 3c5b14b713, July 24, 2024), and the CVE explicitly states it affects versions 9.0.92-9.0.95. Since 9.0.24 predates the introduction of this feature by 68 versions, the vulnerability canno..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-24813" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31650" }, "impact_statement": "Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-46701" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48988" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49124" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49125" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52520" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55668" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55752" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-25854" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-03T16:30:36.061493+00:00", "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.24 is not affected by CVE-2026-29129. The vulnerability concerns cipher preference order not being preserved when merging TLS 1.3 and regular cipher suites using HashSet. This issue was introduced when TLS 1.3 cipher configuration support was added (upstream commit 4ee45c5571, affects 9.0.114+) and fixed in commit 8d69b33764 by using LinkedHashSet. Version 9.0.24 predates the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29129" }, "impact_statement": "not_affected \u2014 Target version 9.0.24 is not affected by CVE-2026-29129. The vulnerability concerns cipher preference order not being preserved when merging TLS 1.3 and regular cipher suites using HashSet. This issue was introduced when TLS 1.3 cipher configuration support was added (upstream commit 4ee45c5571, affects 9.0.114+) and fixed in commit 8d69b33764 by using LinkedHashSet. Version 9.0.24 predates the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32990" }, "impact_statement": "not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-10T04:13:00.045658+00:00", "status_notes": "Vulnerability CVE-2026-34483 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable JsonAccessLogValve component is absent. The default configuration uses AccessLogValve with a plain-text log pattern (conf/server.xml:164), and its output is written directly to a file (java/org/apache/catalina/valves/AccessLogValve.java:615). The only JSON reference in the valves implementation sets an HTTP response content type, providing no JSON access-log path (java/org/apache/catalina/valves/HealthCheckValve.java:57).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34483" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable JsonAccessLogValve component is absent. The default configuration uses AccessLogValve with a plain-text log pattern (conf/server.xml:164), and its output is written directly to a file (java/org/apache/catalina/valves/AccessLogValve.java:615). The only JSON reference in the valves implementation sets an HTTP response content type, providing no JSON access-log path (java/org/apache/catalina/valves/HealthCheckValve.java:57)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T16:52:53.138657+00:00", "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-53404" }, "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T16:48:00.070829+00:00", "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55276" }, "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T16:25:24.528819+00:00", "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55956" }, "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-11-04T16:31:00.070810+00:00", "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55957" }, "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.24-tuxcare.1.", "vulnerability": { "name": "GHSA-r53m-pfr5-7v87" }, "impact_statement": "The vulnerability has been withdrawn." } ] }