{
  "@id": "urn:uuid:27e23a0b-8227-4d08-baa0-60192c399481",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T08:55:43.894341+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Tomcat's host-manager where the name parameter was not HTML-escaped before rendering. The target (Tomcat 9.0.50) properly escapes all user inputs including the name parameter via Escape.htmlElementContent() before HTML rendering. This protection was introduced in upstream commit 17fdaef177 (October 2017) by Apache developer Mark Thomas and shipped...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Tomcat's host-manager where the name parameter was not HTML-escaped before rendering. The target (Tomcat 9.0.50) properly escapes all user inputs including the name parameter via Escape.htmlElementContent() before HTML rendering. This protection was introduced in upstream commit 17fdaef177 (October 2017) by Apache developer Mark Thomas and shipped..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:07:58.117916+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 is NOT present in Tomcat 9.0.50. The vulnerability affected Apache Tomcat 8.x before 8.0.4, where Content-Length: 0 AJP requests caused thread hangs. The fix was applied by upstream Apache Tomcat in March 2014 (commit 8884dae60ac by Mark Thomas). This fix is present in the target at java/org/apache/coyote/ajp/AjpProcessor.java:627-630, where contentLength == 0 triggers immediate e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 is NOT present in Tomcat 9.0.50. The vulnerability affected Apache Tomcat 8.x before 8.0.4, where Content-Length: 0 AJP requests caused thread hangs. The fix was applied by upstream Apache Tomcat in March 2014 (commit 8884dae60ac by Mark Thomas). This fix is present in the target at java/org/apache/coyote/ajp/AjpProcessor.java:627-630, where contentLength == 0 triggers immediate e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 9.0.50 is not affected by CVE-2017-12615. The vulnerability pattern (OS filename normalization allowing file creation with different names than requested) is not present because the upstream Apache Tomcat fix was already included in the 9.0.50 release. The fix (commit a9dd96046d7, 2017-09-25) adds isInvalidWindowsFilename() validation that explicitly rejects filenames ending with trailing spaces, plus canonical path comparison to detect Windows filename normalization. These defenses were shipped with the upstream release and are present at the target SHA e8f9549bc7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Target Tomcat 9.0.50 is not affected by CVE-2017-12615. The vulnerability pattern (OS filename normalization allowing file creation with different names than requested) is not present because the upstream Apache Tomcat fix was already included in the 9.0.50 release. The fix (commit a9dd96046d7, 2017-09-25) adds isInvalidWindowsFilename() validation that explicitly rejects filenames ending with trailing spaces, plus canonical path comparison to detect Windows filename normalization. These defenses were shipped with the upstream release and are present at the target SHA e8f9549bc7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is NOT present in Tomcat 9.0.50. The vulnerability allowed uploading JSP files via HTTP PUT with trailing-slash manipulation (e.g., \"file.jsp/\" creates \"file.jsp\" due to Java File API behavior). Apache fixed this in September 2017 via commits b7e0435d17 (blocks write operations with trailing slash) and b577f9a799 (blocks file lookups with trailing slash). Both fixes are present in HEAD and shipped in the upstream 9.0.1+ releases, well before 9.0.50. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is NOT present in Tomcat 9.0.50. The vulnerability allowed uploading JSP files via HTTP PUT with trailing-slash manipulation (e.g., \"file.jsp/\" creates \"file.jsp\" due to Java File API behavior). Apache fixed this in September 2017 via commits b7e0435d17 (blocks write operations with trailing slash) and b577f9a799 (blocks file lookups with trailing slash). Both fixes are present in HEAD and shipped in the upstream 9.0.1+ releases, well before 9.0.50. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Tomcat 9.0.50. The vulnerability involved application listeners receiving unfacaded internal Request/Response objects under SecurityManager, allowing cross-application data access. The upstream Apache fix (commit dfa4086342, March 2017) wrapped all listener invocations with facades via request.getRequest(). This fix was already present in the upstream 9.0.50 release (July 2021) that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) use facades in the target. No vulnerable code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is NOT present in Tomcat 9.0.50. The vulnerability involved application listeners receiving unfacaded internal Request/Response objects under SecurityManager, allowing cross-application data access. The upstream Apache fix (commit dfa4086342, March 2017) wrapped all listener invocations with facades via request.getRequest(). This fix was already present in the upstream 9.0.50 release (July 2021) that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) use facades in the target. No vulnerable code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Target version 9.0.50 is not affected by CVE-2017-5651. The vulnerability (processor double-caching during rapid sendfile completion causing response mix-up) was fixed by upstream commit 9233d9d6a0 (March 2017) authored by Mark Thomas. This fix was already present in the upstream release before TuxCare began maintaining this branch. The vulnerable code pattern (using sendfileData for state determination, clearing it in prepareRequest) is absent. The fix (SendfileState tracking, preserved sendfileData) is fully present in Http11Processor.java lines 262, 265, 451, 463, and the processSendfile method at line 1354.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "Target version 9.0.50 is not affected by CVE-2017-5651. The vulnerability (processor double-caching during rapid sendfile completion causing response mix-up) was fixed by upstream commit 9233d9d6a0 (March 2017) authored by Mark Thomas. This fix was already present in the upstream release before TuxCare began maintaining this branch. The vulnerable code pattern (using sendfileData for state determination, clearing it in prepareRequest) is absent. The fix (SendfileState tracking, preserved sendfileData) is fully present in Http11Processor.java lines 262, 265, 451, 463, and the processSendfile method at line 1354.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is not present in Apache Tomcat 9.0.50. The vulnerability involved crafted URLs that could generate protocol-relative redirects (e.g., //evil.com/path) in the DefaultServlet's directory redirect logic, allowing redirection to attacker-controlled URIs. The upstream Apache Tomcat project fixed this issue by adding slash normalization in the doDirectoryRedirect method before version...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 is not present in Apache Tomcat 9.0.50. The vulnerability involved crafted URLs that could generate protocol-relative redirects (e.g., //evil.com/path) in the DefaultServlet's directory redirect logic, allowing redirection to attacker-controlled URIs. The upstream Apache Tomcat project fixed this issue by adding slash normalization in the doDirectoryRedirect method before version..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T14:33:24.546262+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is not present in Tomcat 9.0.50. The vulnerability, which allowed security constraints with empty-string URL patterns (\"\") to be bypassed, was fixed in upstream Apache Tomcat 9.0.5 by commit 723ea6a5bc (Feb 2018, author markt@apache.org). The fix adds special-case handling to match empty-string patterns against the context root (\"/\"). This fix predates TuxCare's maintenance of ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 is not present in Tomcat 9.0.50. The vulnerability, which allowed security constraints with empty-string URL patterns (\"\") to be bypassed, was fixed in upstream Apache Tomcat 9.0.5 by commit 723ea6a5bc (Feb 2018, author markt@apache.org). The fix adds special-case handling to match empty-string patterns against the context root (\"/\"). This fix predates TuxCare's maintenance of ver..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 fix was already present in the upstream Apache Tomcat 9.0.50 release that TuxCare onboarded. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.4, and the fix was applied by upstream in February 2018 (commit 3e54b2a6). Version 9.0.50 (released June 2021) is well beyond the affected range and contains the fix. The target code correctly processes ServletSecurity annotations at applic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 fix was already present in the upstream Apache Tomcat 9.0.50 release that TuxCare onboarded. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.4, and the fix was applied by upstream in February 2018 (commit 3e54b2a6). Version 9.0.50 (released June 2021) is well beyond the affected range and contains the fix. The target code correctly processes ServletSecurity annotations at applic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Target version 9.0.50 is NOT vulnerable to CVE-2018-1336. The upstream fix for the UTF-8 decoder infinite loop vulnerability was already present in Apache Tomcat 9.0.50 when TuxCare onboarded it. The fix (position rewinding logic in Utf8Decoder.java lines 280-286) was authored by Mark Thomas (markt@apache.org) in April 2018 (commit 92cd494555), and version 9.0.50 is well outside the affected version range (9.0.0.M9 to 9.0.7). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Target version 9.0.50 is NOT vulnerable to CVE-2018-1336. The upstream fix for the UTF-8 decoder infinite loop vulnerability was already present in Apache Tomcat 9.0.50 when TuxCare onboarded it. The fix (position rewinding logic in Utf8Decoder.java lines 280-286) was authored by Mark Thomas (markt@apache.org) in April 2018 (commit 92cd494555), and version 9.0.50 is well outside the affected version range (9.0.0.M9 to 9.0.7). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 affects Apache Tomcat CORS filter default configuration (allowedOrigins=\"*\" with supportsCredentials=\"true\"), allowing unauthorized cross-origin access to credentials. The target repository (Tomcat 9.0.50) is NOT AFFECTED because the upstream fix by Mark Thomas (commit d83a76732e, May 2018) was already included in the Tomcat 9.0.50 release before TuxCare began maintaining this version. All four fix components are present: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation rejecting the insecure combination, and simplified header logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 affects Apache Tomcat CORS filter default configuration (allowedOrigins=\"*\" with supportsCredentials=\"true\"), allowing unauthorized cross-origin access to credentials. The target repository (Tomcat 9.0.50) is NOT AFFECTED because the upstream fix by Mark Thomas (commit d83a76732e, May 2018) was already included in the Tomcat 9.0.50 release before TuxCare began maintaining this version. All four fix components are present: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation rejecting the insecure combination, and simplified header logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034: Target version 9.0.50 is NOT AFFECTED. The vulnerability (missing hostname verification in WebSocket TLS client) was fixed by upstream Apache in commit 2835bb4e03 on 2018-06-18, three years before the 9.0.50 release (2021-06-28). The fix is present in the target at WsWebSocketContainer.java:952-958, where SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification. The CVE affected versions 9.0.0.M1 to 9.0.9; version 9.0.50 shipped with the fix already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034: Target version 9.0.50 is NOT AFFECTED. The vulnerability (missing hostname verification in WebSocket TLS client) was fixed by upstream Apache in commit 2835bb4e03 on 2018-06-18, three years before the 9.0.50 release (2021-06-28). The fix is present in the target at WsWebSocketContainer.java:952-958, where SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification. The CVE affected versions 9.0.0.M1 to 9.0.9; version 9.0.50 shipped with the fix already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T01:20:00.176669+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Tomcat 9.0.50 is not affected by CVE-2018-8037. This race condition vulnerability affecting async request timeout processing was fixed in upstream Apache Tomcat with commit 575cbbcef on June 19, 2018. The fix was already present in the Apache Tomcat 9.0.50 release that TuxCare onboarded. All defense mechanisms are present: generation tracking in AsyncStateMachine that increments on e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 The target Tomcat 9.0.50 is not affected by CVE-2018-8037. This race condition vulnerability affecting async request timeout processing was fixed in upstream Apache Tomcat with commit 575cbbcef on June 19, 2018. The fix was already present in the Apache Tomcat 9.0.50 release that TuxCare onboarded. All defense mechanisms are present: generation tracking in AsyncStateMachine that increments on e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 addresses HTTP/2 DoS vulnerabilities via thread exhaustion. The target (Tomcat 9.0.50) is NOT AFFECTED because the upstream Apache Tomcat release already contained the complete fix before TuxCare onboarded it. Both defense mechanisms are present: (1) stream-level read/write timeouts (20s default) prevent indefinite blocking on I/O operations, and (2) overhead frame counting tracks the ratio of overhead frames (SETTINGS, PING, PRIORITY) to data frames, closing connections when the ratio exceeds safe thresholds. These fixes were authored by Mark Thomas (markt@apache.org) on Feb 1, 2019, and were part of the upstream release that TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 addresses HTTP/2 DoS vulnerabilities via thread exhaustion. The target (Tomcat 9.0.50) is NOT AFFECTED because the upstream Apache Tomcat release already contained the complete fix before TuxCare onboarded it. Both defense mechanisms are present: (1) stream-level read/write timeouts (20s default) prevent indefinite blocking on I/O operations, and (2) overhead frame counting tracks the ratio of overhead frames (SETTINGS, PING, PRIORITY) to data frames, closing connections when the ratio exceeds safe thresholds. These fixes were authored by Mark Thomas (markt@apache.org) on Feb 1, 2019, and were part of the upstream release that TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat versions 9.0.0.M1 to 9.0.17. The target is version 9.0.50, which already contains the fix in the upstream release. The SSIPrintenv command uses entity encoding (SSIMediator.ENCODING_ENTITY) to escape user-provided data before output, preventing XSS. The fix was introduced by upstream commit 15fcd166ea by Mark Thomas (markt@apache.org) on March 11, 2019, well ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects Apache Tomcat versions 9.0.0.M1 to 9.0.17. The target is version 9.0.50, which already contains the fix in the upstream release. The SSIPrintenv command uses entity encoding (SSIMediator.ENCODING_ENTITY) to escape user-provided data before output, preventing XSS. The fix was introduced by upstream commit 15fcd166ea by Mark Thomas (markt@apache.org) on March 11, 2019, well ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 9.0.50 is NOT affected by CVE-2019-0232. The fix for this Windows CGI command injection vulnerability was shipped in upstream Apache Tomcat 9.0.18 (April 2019) and is present in version 9.0.50. The defense validates decoded command line arguments against a restrictive pattern on Windows, rejecting special characters that could enable command injection. Fix commit 4b244d827a was authored by markt@apache.org (Apache upstream), confirming this was part of the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "The target Apache Tomcat 9.0.50 is NOT affected by CVE-2019-0232. The fix for this Windows CGI command injection vulnerability was shipped in upstream Apache Tomcat 9.0.18 (April 2019) and is present in version 9.0.50. The defense validates decoded command line arguments against a restrictive pattern on Windows, rejecting special characters that could enable command injection. Fix commit 4b244d827a was authored by markt@apache.org (Apache upstream), confirming this was part of the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 9.0.50 is not affected by CVE-2019-10072. The vulnerability (HTTP/2 connection window exhaustion causing indefinite thread blocking and DoS) was fixed in upstream Apache Tomcat 9.0.20 (April-May 2019) via commit 7f748eb6bf by Mark Thomas. The fix adds timeout-based waiting when the connection window is exhausted; if no allocation is received within the timeout, the connection and stream are closed to prevent thread exhaustion. Target version 9.0.50 (released June 2021) shipped with this fix already present. The defense has been refactored into WindowAllocationManager but retains the timeout protection. Git history confirms the fix commit is an ancestor of the first TuxCare commit (1050df4f18), proving it was in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "Target Tomcat 9.0.50 is not affected by CVE-2019-10072. The vulnerability (HTTP/2 connection window exhaustion causing indefinite thread blocking and DoS) was fixed in upstream Apache Tomcat 9.0.20 (April-May 2019) via commit 7f748eb6bf by Mark Thomas. The fix adds timeout-based waiting when the connection window is exhausted; if no allocation is received within the timeout, the connection and stream are closed to prevent thread exhaustion. Target version 9.0.50 (released June 2021) shipped with this fix already present. The defense has been refactored into WindowAllocationManager but retains the timeout protection. Git history confirms the fix commit is an ancestor of the first TuxCare commit (1050df4f18), proving it was in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 does not affect this target. The vulnerability was fixed in Apache Tomcat 9.0.29 (released November 2019) via a custom JmxRegistry implementation that prevents RMI registry manipulation. The target is running version 9.0.50, which already includes this upstream fix. The vulnerable pattern (using standard LocateRegistry.createRegistry with mutable bind/unbind/rebind operations) is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 does not affect this target. The vulnerability was fixed in Apache Tomcat 9.0.29 (released November 2019) via a custom JmxRegistry implementation that prevents RMI registry manipulation. The target is running version 9.0.50, which already includes this upstream fix. The vulnerable pattern (using standard LocateRegistry.createRegistry with mutable bind/unbind/rebind operations) is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 session fixation vulnerability is not present in Tomcat 9.0.50-tuxcare.16. The upstream fix by Mark Thomas (commit 1ecba14e690cf5f3f143eef6ae7037a6d3c16652, 2019-12-05) was already shipped in the Apache Tomcat 9.0.50 release that TuxCare onboarded. The fix refactors FORM authentication to eliminate the timing window by ensuring Principal registration happens immediately after authentication and deferring cached authentication checks until after saved request restoration. All fix components verified: checkForCachedAuthentication() positioned after saved request restoration (FormAuthenticator.java:188), FormAuthenticator.register() override handles username/password storage when cache==false (lines 361-384), FORM_PRINCIPAL_NOTE deprecated (Constants.java:88-91), and AuthenticatorBase.register() only caches Principal when session exists and cache==true (AuthenticatorBase.java:1200-1203).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 session fixation vulnerability is not present in Tomcat 9.0.50-tuxcare.16. The upstream fix by Mark Thomas (commit 1ecba14e690cf5f3f143eef6ae7037a6d3c16652, 2019-12-05) was already shipped in the Apache Tomcat 9.0.50 release that TuxCare onboarded. The fix refactors FORM authentication to eliminate the timing window by ensuring Principal registration happens immediately after authentication and deferring cached authentication checks until after saved request restoration. All fix components verified: checkForCachedAuthentication() positioned after saved request restoration (FormAuthenticator.java:188), FormAuthenticator.register() override handles username/password storage when cache==false (lines 361-384), FORM_PRINCIPAL_NOTE deprecated (Constants.java:88-91), and AuthenticatorBase.register() only caches Principal when session exists and cache==true (AuthenticatorBase.java:1200-1203).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:56.766712+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.50 is not affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix was applied by Apache upstream in commit 060ecc5eb839208687b7fcc9e35287ac8eb46998 (authored Dec 17, 2019 by Mark Thomas) and was already present in the upstr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.50 is not affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix was applied by Apache upstream in commit 060ecc5eb839208687b7fcc9e35287ac8eb46998 (authored Dec 17, 2019 by Mark Thomas) and was already present in the upstr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Version 9.0.50 is not vulnerable. Summary: The target repository contains a functionally equivalent fix for CVE-2020-11996. While the implementation differs from the provided patch, it addresses the same performance issue using a more efficient approach with ConcurrentNavigableMap.subMap(). [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 9.0.50 is not vulnerable. Summary: The target repository contains a functionally equivalent fix for CVE-2020-11996. While the implementation differs from the provided patch, it addresses the same performance issue using a more efficient approach with ConcurrentNavigableMap.subMap(). [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 is NOT present in the target. The vulnerability affected Apache Tomcat 9.0.0.M1 to 9.0.30 due to lenient HTTP header parsing that accepted malformed CRLF sequences and control characters in header values. The fix was introduced by upstream Apache in commit 8bfb0ff7f2 (2020-01-06) and first released in version 9.0.31. The target is running version 9.0.50, which is 19 versions after...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 is NOT present in the target. The vulnerability affected Apache Tomcat 9.0.0.M1 to 9.0.30 due to lenient HTTP header parsing that accepted malformed CRLF sequences and control characters in header values. The fix was introduced by upstream Apache in commit 8bfb0ff7f2 (2020-01-06) and first released in version 9.0.31. The target is running version 9.0.50, which is 19 versions after..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Tomcat 9.0.50. All three vendor-supplied defenses are present: (1) AJP connector disabled by default in server.xml, (2) default bind to loopback address (127.0.0.1/::1), (3) mandatory secret authentication with secretRequired=true default, and (4) attribute blocking that rejects unrecognized AJP request attributes. The fix was authored by Mark Thomas (markt@apache.org) in upstream Apache Tomcat and was already included in the 9.0.50 release before TuxCare onboarded this version. Tomcat 9.0.50 was released after 9.0.31, which introduced the CVE-2020-1938 fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Tomcat 9.0.50. All three vendor-supplied defenses are present: (1) AJP connector disabled by default in server.xml, (2) default bind to loopback address (127.0.0.1/::1), (3) mandatory secret authentication with secretRequired=true default, and (4) attribute blocking that rejects unrecognized AJP request attributes. The fix was authored by Mark Thomas (markt@apache.org) in upstream Apache Tomcat and was already included in the 9.0.50 release before TuxCare onboarded this version. Tomcat 9.0.50 was released after 9.0.31, which introduced the CVE-2020-1938 fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 affects Apache Tomcat 9.0.0.M1 to 9.0.41, where h2c connection handling could duplicate request headers and body data between users. The target is Tomcat 9.0.50-tuxcare.16, which is after the affected range. All four upstream fix commits (addressing bug 64830) are present on HEAD and were shipped in the Apache Tomcat 9.0.50 release before any TuxCare modifications. Direct code inspection confirms the fixes: AbstractProtocol.java restores leftover input before processor creation (line 906), HpackDecoder.java uses local StringBuilder instances (lines 226, 234), and ConnectionSettingsBase.java uses ConcurrentHashMap for thread safety (lines 47-48). The vulnerability pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 affects Apache Tomcat 9.0.0.M1 to 9.0.41, where h2c connection handling could duplicate request headers and body data between users. The target is Tomcat 9.0.50-tuxcare.16, which is after the affected range. All four upstream fix commits (addressing bug 64830) are present on HEAD and were shipped in the Apache Tomcat 9.0.50 release before any TuxCare modifications. Direct code inspection confirms the fixes: AbstractProtocol.java restores leftover input before processor creation (line 906), HpackDecoder.java uses local StringBuilder instances (lines 226, 234), and ConnectionSettingsBase.java uses ConcurrentHashMap for thread safety (lines 47-48). The vulnerability pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 (incomplete fix for CVE-2020-9484) affects path traversal validation in Tomcat's session persistence and file operations. The target Apache Tomcat 9.0.50 is NOT AFFECTED because the upstream fix (commit 4785433a22 by Mark Thomas, 2021-01-20) was already included in the 9.0.50 release, replacing vulnerable string-based path comparisons with NIO Path-based comparisons across FileStore, DefaultServlet, ExpandWar, HostConfig, and ContextConfig. Verification confirms zero instances of the vulnerable getCanonicalPath().startsWith() pattern remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 (incomplete fix for CVE-2020-9484) affects path traversal validation in Tomcat's session persistence and file operations. The target Apache Tomcat 9.0.50 is NOT AFFECTED because the upstream fix (commit 4785433a22 by Mark Thomas, 2021-01-20) was already included in the 9.0.50 release, replacing vulnerable string-based path comparisons with NIO Path-based comparisons across FileStore, DefaultServlet, ExpandWar, HostConfig, and ContextConfig. Verification confirms zero instances of the vulnerable getCanonicalPath().startsWith() pattern remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-45143"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "action_statement": "Vulnerability CVE-2023-28709 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "action_statement": "Vulnerability CVE-2023-34981 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.11."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:43:00.122669+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 9.0.50-tuxcare.16 is not affected by CVE-2024-21733. The vulnerability affects versions 9.0.0-M11 through 9.0.43, and the fix was introduced in upstream version 9.0.44 (February 2021). Since the target is based on upstream 9.0.50 (released June 2021), the fix was already present in the upstream release when TuxCare adopted this version. Both required patches are present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.50-tuxcare.16 is not affected by CVE-2024-21733. The vulnerability affects versions 9.0.0-M11 through 9.0.43, and the fix was introduced in upstream version 9.0.44 (February 2021). Since the target is based on upstream 9.0.50 (released June 2021), the fix was already present in the upstream release when TuxCare adopted this version. Both required patches are present..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-27T18:17:07.320364+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.16."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.10."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.50 does not contain CVE-2024-52317. The vulnerability affects versions 9.0.92-9.0.95 where request/response object pooling was introduced. In 9.0.50, Request objects are created new for each HTTP/2 stream (Stream.java:104 `new Request()`), and no pooling mechanism exists. The vulnerable code path (pushRequestAndResponse/popRequestAndResponse methods for returning objects to a ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.50 does not contain CVE-2024-52317. The vulnerability affects versions 9.0.92-9.0.95 where request/response object pooling was introduced. In 9.0.50, Request objects are created new for each HTTP/2 stream (Stream.java:104 `new Request()`), and no pooling mechanism exists. The vulnerable code path (pushRequestAndResponse/popRequestAndResponse methods for returning objects to a ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.12."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. 9.0.50 predates HTTP/2 RFC 9218 PRIORITY_UPDATE frame support (added in 9.0.76). Advisory range per NVD/Snyk/GHSA is 9.0.76-9.0.102. Code inspection confirms: Http2Parser.processFramePriorityUpdate method and priority parsing in Stream.emitHeader do not exist in this baseline. Vulnerable code path is absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "9.0.50 predates HTTP/2 RFC 9218 PRIORITY_UPDATE frame support (added in 9.0.76). Advisory range per NVD/Snyk/GHSA is 9.0.76-9.0.102. Code inspection confirms: Http2Parser.processFramePriorityUpdate method and priority parsing in Stream.emitHeader do not exist in this baseline. Vulnerable code path is absent."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.14.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "action_statement": "Vulnerability CVE-2025-48989 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.14."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:30:36.061493+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2026-29129. This vulnerability affects versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The target version 9.0.50 predates the vulnerable code by 64 minor versions. The bug was introduced when TLS 1.3 cipher suite support was added (commit 4ee45c5571, January 2026), which used a HashSet that destroyed the configured cipher order. Versio...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2026-29129. This vulnerability affects versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The target version 9.0.50 predates the vulnerable code by 64 minor versions. The bug was introduced when TLS 1.3 cipher suite support was added (commit 4ee45c5571, January 2026), which used a HashSet that destroyed the configured cipher order. Versio..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-27T18:17:07.320364+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.16."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T19:10:07.033142+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.17.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.17."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-05T08:55:43.894341+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.18.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.18."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T19:10:07.033142+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.17.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.50-tuxcare.17."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.50-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.50-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.50-tuxcare.9.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}