{
  "@id": "urn:uuid:0c5cbfef-0473-4407-8522-24734f08ea9f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:47.660203+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 XSS vulnerability in Apache Tomcat host-manager is NOT AFFECTED in version 9.0.75. The fix for this CVE (commit 49c71fc59c by Mark Thomas, Apache) was applied on June 2, 2008, and was already present in the upstream Apache Tomcat release that TuxCare onboarded for version 9.0.75. The current code properly escapes the hostname parameter using Escape.htmlElementContent() before rend...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 XSS vulnerability in Apache Tomcat host-manager is NOT AFFECTED in version 9.0.75. The fix for this CVE (commit 49c71fc59c by Mark Thomas, Apache) was applied on June 2, 2008, and was already present in the upstream Apache Tomcat release that TuxCare onboarded for version 9.0.75. The current code properly escapes the hostname parameter using Escape.htmlElementContent() before rend..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:30.945793+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS via AJP requests with Content-Length: 0. The fix for this vulnerability is present in Tomcat 9.0.75-tuxcare.7. The fix (commit 8884dae60ac) was authored by upstream Apache developer Mark Thomas on 2014-03-17 and was already part of the upstream Tomcat codebase when TuxCare onboarded this repository in July 2025. The vulnerable pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS via AJP requests with Content-Length: 0. The fix for this vulnerability is present in Tomcat 9.0.75-tuxcare.7. The fix (commit 8884dae60ac) was authored by upstream Apache developer Mark Thomas on 2014-03-17 and was already part of the upstream Tomcat codebase when TuxCare onboarded this repository in July 2025. The vulnerable pa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affects Tomcat 7.0.0-7.0.79 where specially crafted filenames (with trailing spaces/dots) could bypass JSP upload restrictions on Windows. The target Tomcat 9.0.75 uses a completely different architecture (WebResourceRoot/AbstractFileResourceSet instead of FileDirContext) and contains upstream fix commit a9dd96046d (2017-09-25) that explicitly validates Windows filenames and rejects trailing spaces before file creation. This fix was already present in the upstream release when TuxCare onboarded version 9.0.75, so the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affects Tomcat 7.0.0-7.0.79 where specially crafted filenames (with trailing spaces/dots) could bypass JSP upload restrictions on Windows. The target Tomcat 9.0.75 uses a completely different architecture (WebResourceRoot/AbstractFileResourceSet instead of FileDirContext) and contains upstream fix commit a9dd96046d (2017-09-25) that explicitly validates Windows filenames and rejects trailing spaces before file creation. This fix was already present in the upstream release when TuxCare onboarded version 9.0.75, so the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is not present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability allowed uploading JSP files via HTTP PUT when readonly=false by exploiting Java's File API normalization of trailing slashes (e.g., \"shell.jsp/\" \u2192 \"shell.jsp\"). The upstream vendor (Apache) fixed this in commit b7e0435d17 by adding validation to reject paths ending in '/' during file creation and lookup operations. This fix was already included in the upstream Apache Tomcat 9.0.75 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of both the upstream 9.0.75 tag and predating the first TuxCare commit in HEAD's history. The target contains both required defenses: DirResourceSet.write() rejects creation paths ending in '/', and AbstractFileResourceSet.file() returns null for such paths during lookups.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is not present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability allowed uploading JSP files via HTTP PUT when readonly=false by exploiting Java's File API normalization of trailing slashes (e.g., \"shell.jsp/\" \u2192 \"shell.jsp\"). The upstream vendor (Apache) fixed this in commit b7e0435d17 by adding validation to reject paths ending in '/' during file creation and lookup operations. This fix was already included in the upstream Apache Tomcat 9.0.75 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of both the upstream 9.0.75 tag and predating the first TuxCare commit in HEAD's history. The target contains both required defenses: DirResourceSet.write() rejects creation paths ending in '/', and AbstractFileResourceSet.file() returns null for such paths during lookups.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.75. The vulnerability affected versions up to 9.0.0.M17, requiring facade objects when firing application listeners to prevent untrusted code from retaining references to internal request/response objects under SecurityManager. The fix was committed to upstream Apache Tomcat by Mark Thomas (markt@apache.org) on March 6, 2017, approximately 6 years before the 9.0.75 release. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() to pass facade objects when firing listener events. The fix commit dfa40863421d7681fed893b4256666491887e38c is an ancestor of both the upstream 9.0.75 tag and the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is NOT present in Apache Tomcat 9.0.75. The vulnerability affected versions up to 9.0.0.M17, requiring facade objects when firing application listeners to prevent untrusted code from retaining references to internal request/response objects under SecurityManager. The fix was committed to upstream Apache Tomcat by Mark Thomas (markt@apache.org) on March 6, 2017, approximately 6 years before the 9.0.75 release. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() to pass facade objects when firing listener events. The fix commit dfa40863421d7681fed893b4256666491887e38c is an ancestor of both the upstream 9.0.75 tag and the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 9.0.75 is not affected by CVE-2017-5651. The vulnerability pattern (premature Processor recycling when sendfile completes quickly) was removed by upstream commit 9233d9d6a0 authored by Mark Thomas (markt@apache.org), which shipped in the upstream release before TuxCare's first maintenance commit. All patch changes are verified present in the target code: SendfileState tracking, modified while loop condition, processSendfile() method, and removed sendfileData clearing in prepareRequest().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "The target Tomcat 9.0.75 is not affected by CVE-2017-5651. The vulnerability pattern (premature Processor recycling when sendfile completes quickly) was removed by upstream commit 9233d9d6a0 authored by Mark Thomas (markt@apache.org), which shipped in the upstream release before TuxCare's first maintenance commit. All patch changes are verified present in the target code: SendfileState tracking, modified while loop condition, processSendfile() method, and removed sendfileData clearing in prepareRequest().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is NOT present in Apache Tomcat 9.0.75. The vulnerability allowed attackers to craft URLs that would generate protocol-relative redirects (e.g., //evil.com) via the DefaultServlet's directory redirect mechanism. The fix that prevents this attack by removing redundant leading slashes from redirect locations is already present in the target code at DefaultServlet.java:1409-1412. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 is NOT present in Apache Tomcat 9.0.75. The vulnerability allowed attackers to craft URLs that would generate protocol-relative redirects (e.g., //evil.com) via the DefaultServlet's directory redirect mechanism. The fix that prevents this attack by removing redundant leading slashes from redirect locations is already present in the target code at DefaultServlet.java:1409-1412. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T14:32:39.171329+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 9.0.75 is NOT affected by CVE-2018-1304. The vulnerability was fixed in upstream commit 723ea6a5bc by Mark Thomas (Apache) on Feb 6, 2018, which is present in HEAD. The fix adds special handling to match empty string (\"\") URL patterns to the context root (\"/\") in security constraint evaluation. This upstream fix was already in the release before TuxCare onboarding (5075 commits before th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 Tomcat 9.0.75 is NOT affected by CVE-2018-1304. The vulnerability was fixed in upstream commit 723ea6a5bc by Mark Thomas (Apache) on Feb 6, 2018, which is present in HEAD. The fix adds special handling to match empty string (\"\") URL patterns to the context root (\"/\") in security constraint evaluation. This upstream fix was already in the release before TuxCare onboarding (5075 commits before th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability (lazy ServletSecurity annotation processing allowing unauthorized access) was fixed by upstream Apache in February 2018 (commit 3e54b2a6 by Mark Thomas). This fix was included in the upstream 9.0.75 release (May 2023) that TuxCare onboarded. The target contains the fix: eager annotation processing at startup via W...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability (lazy ServletSecurity annotation processing allowing unauthorized access) was fixed by upstream Apache in February 2018 (commit 3e54b2a6 by Mark Thomas). This fix was included in the upstream 9.0.75 release (May 2023) that TuxCare onboarded. The target contains the fix: eager annotation processing at startup via W..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 describes an infinite loop vulnerability in Apache Tomcat's UTF-8 decoder when handling supplementary characters with buffer overflow conditions. The vulnerability was fixed by Apache in commit 92cd494555 (April 2018) which added position rewinding logic before returning overflow. This fix is already present in the target Apache Tomcat 9.0.75 at lines 280-286 of Utf8Decoder.java. The fix was part of the upstream release when TuxCare onboarded version 9.0.75, as confirmed by ancestry analysis showing the fix commit predates all TuxCare commits in this branch's history. Target version 9.0.75 is also much newer than the CVE's stated affected range (9.0.0.M9 to 9.0.7), though the verdict is based on code analysis, not version metadata.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 describes an infinite loop vulnerability in Apache Tomcat's UTF-8 decoder when handling supplementary characters with buffer overflow conditions. The vulnerability was fixed by Apache in commit 92cd494555 (April 2018) which added position rewinding logic before returning overflow. This fix is already present in the target Apache Tomcat 9.0.75 at lines 280-286 of Utf8Decoder.java. The fix was part of the upstream release when TuxCare onboarded version 9.0.75, as confirmed by ancestry analysis showing the fix commit predates all TuxCare commits in this branch's history. Target version 9.0.75 is also much newer than the CVE's stated affected range (9.0.0.M9 to 9.0.7), though the verdict is based on code analysis, not version metadata.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 affects insecure CORS filter default settings that enabled credentials support for all origins. The vulnerable pattern (DEFAULT_ALLOWED_ORIGINS=\"*\" with DEFAULT_SUPPORTS_CREDENTIALS=\"true\") is not present in target version 9.0.75. The upstream Apache fix (commit d83a76732e by markt@apache.org, May 2018) changed defaults to \"\" and \"false\" respectively, and added validation preventing the dangerous combination. This fix shipped in upstream release 9.0.75 (May 2023), before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 affects insecure CORS filter default settings that enabled credentials support for all origins. The vulnerable pattern (DEFAULT_ALLOWED_ORIGINS=\"*\" with DEFAULT_SUPPORTS_CREDENTIALS=\"true\") is not present in target version 9.0.75. The upstream Apache fix (commit d83a76732e by markt@apache.org, May 2018) changed defaults to \"\" and \"false\" respectively, and added validation preventing the dangerous combination. This fix shipped in upstream release 9.0.75 (May 2023), before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 is NOT present in Tomcat 9.0.75. The vulnerability (missing hostname verification in TLS WebSocket client connections) was fixed in the upstream Apache Tomcat release. The fix commit (2835bb4e030c1c741ed0847bb3b9c3822e4fbc8a by Mark Thomas) is present in HEAD and predates the first TuxCare commit, confirming it shipped in the upstream Tomcat 9.0.75 release that TuxCare onboarded. The target code at WsWebSocketContainer.java:929-935 shows hostname verification is enabled unconditionally via sslParams.setEndpointIdentificationAlgorithm(\"HTTPS\"). Target version 9.0.75 is well beyond the affected version range (9.0.0.M1 to 9.0.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 is NOT present in Tomcat 9.0.75. The vulnerability (missing hostname verification in TLS WebSocket client connections) was fixed in the upstream Apache Tomcat release. The fix commit (2835bb4e030c1c741ed0847bb3b9c3822e4fbc8a by Mark Thomas) is present in HEAD and predates the first TuxCare commit, confirming it shipped in the upstream Tomcat 9.0.75 release that TuxCare onboarded. The target code at WsWebSocketContainer.java:929-935 shows hostname verification is enabled unconditionally via sslParams.setEndpointIdentificationAlgorithm(\"HTTPS\"). Target version 9.0.75 is well beyond the affected version range (9.0.0.M1 to 9.0.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T01:22:00.111260+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 fix is present in Apache Tomcat 9.0.75. The vulnerability involved a race condition where async request completion by the application coinciding with container timeout could cause response mixing between users. The upstream fix (commit 575cbbcef2, June 2018) added generation tracking to async state machines, allowing the container to detect and discard stale timeout events. This f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 fix is present in Apache Tomcat 9.0.75. The vulnerability involved a race condition where async request completion by the application coinciding with container timeout could cause response mixing between users. The upstream fix (commit 575cbbcef2, June 2018) added generation tracking to async state machines, allowing the container to detect and discard stale timeout events. This f..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Target version 9.0.75 is not affected by CVE-2019-0199. All required defense mechanisms (stream-level read/write timeouts and overhead frame tracking) are present in the target code. These fixes were committed to upstream Apache Tomcat in February 2019 (well before the 9.0.75 release in May 2023) and were included in the upstream release that TuxCare onboarded. The vulnerable code pattern\u2014indefinite blocking on stream I/O operations and unbounded overhead frame acceptance\u2014does not exist in this version. The CVE affected versions 9.0.0.M1 to 9.0.14; version 9.0.75 is well beyond this range and shipped with the fixes already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "Target version 9.0.75 is not affected by CVE-2019-0199. All required defense mechanisms (stream-level read/write timeouts and overhead frame tracking) are present in the target code. These fixes were committed to upstream Apache Tomcat in February 2019 (well before the 9.0.75 release in May 2023) and were included in the upstream release that TuxCare onboarded. The vulnerable code pattern\u2014indefinite blocking on stream I/O operations and unbounded overhead frame acceptance\u2014does not exist in this version. The CVE affected versions 9.0.0.M1 to 9.0.14; version 9.0.75 is well beyond this range and shipped with the fixes already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which outputs environment variables without HTML encoding, enabling XSS attacks. The target Apache Tomcat 9.0.75 repository is NOT AFFECTED because the upstream fix (commit 15fcd166ea by markt@apache.org from March 2019) was already present in the Apache Tomcat 9.0.75 release that TuxCare onboarded. The code at HEAD correctly uses getVariableValue(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which outputs environment variables without HTML encoding, enabling XSS attacks. The target Apache Tomcat 9.0.75 repository is NOT AFFECTED because the upstream fix (commit 15fcd166ea by markt@apache.org from March 2019) was already present in the Apache Tomcat 9.0.75 release that TuxCare onboarded. The code at HEAD correctly uses getVariableValue(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. The target (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2019-0232. The fix for this Windows-specific CGI command injection vulnerability was already present in the upstream Tomcat 9.0.75 release before TuxCare's maintenance began. The fix (commit 4b244d827a, authored by markt@apache.org) adds validation on decoded CGI command line arguments to prevent injection of special characters that could lead to remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "The target (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2019-0232. The fix for this Windows-specific CGI command injection vulnerability was already present in the upstream Tomcat 9.0.75 release before TuxCare's maintenance began. The fix (commit 4b244d827a, authored by markt@apache.org) adds validation on decoded CGI command line arguments to prevent injection of special characters that could lead to remote code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. The target (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2019-10072. The vulnerability affected versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40. The fix for this HTTP/2 connection window exhaustion DoS was authored by Mark Thomas (markt@apache.org) in commit 7f748eb6bf on 2019-04-30 and shipped in upstream Apache Tomcat 9.0.20+. This fix was already present in the upstream 9.0.75 release that TuxCare onboarded for ELS maintenance. The vulnerable pattern (indefinite wait on connection window exhaustion) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "The target (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2019-10072. The vulnerability affected versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40. The fix for this HTTP/2 connection window exhaustion DoS was authored by Mark Thomas (markt@apache.org) in commit 7f748eb6bf on 2019-04-30 and shipped in upstream Apache Tomcat 9.0.20+. This fix was already present in the upstream 9.0.75 release that TuxCare onboarded for ELS maintenance. The vulnerable pattern (indefinite wait on connection window exhaustion) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.75 is not affected by CVE-2019-12418 because the vulnerable component JmxRemoteLifecycleListener was completely removed from the Apache Tomcat codebase by upstream in version 9.0.57 (Jan 2022), well before version 9.0.75 was released. The upstream removal commit by Mark Thomas (markt@apache.org) eliminated the entire class that was susceptible to RMI registry manipulation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "Tomcat 9.0.75 is not affected by CVE-2019-12418 because the vulnerable component JmxRemoteLifecycleListener was completely removed from the Apache Tomcat codebase by upstream in version 9.0.57 (Jan 2022), well before version 9.0.75 was released. The upstream removal commit by Mark Thomas (markt@apache.org) eliminated the entire class that was susceptible to RMI registry manipulation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 affects Tomcat 9.0.0.M1 to 9.0.29 with a session fixation vulnerability during FORM authentication. The target version 9.0.75 includes the upstream fix (commit 1ecba14e69 by Mark Thomas, 2019-12-05) that shipped in the upstream release before TuxCare onboarding. The fix eliminates temporary Principal storage in session notes, reorders authentication checks to process saved requests before cached authentication, and immediately registers authenticated principals. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 affects Tomcat 9.0.0.M1 to 9.0.29 with a session fixation vulnerability during FORM authentication. The target version 9.0.75 includes the upstream fix (commit 1ecba14e69 by Mark Thomas, 2019-12-05) that shipped in the upstream release before TuxCare onboarding. The fix eliminates temporary Principal storage in session notes, reorders authentication checks to process saved requests before cached authentication, and immediately registers authenticated principals. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:25:43.115991+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28-9.0.30 (regression in Transfer-Encoding header parsing). The target version 9.0.75 (released May 2023) contains the upstream fix from December 2019 (commit 060ecc5e by Mark Thomas). The fix validates Transfer-Encoding headers using TokenList.parseTokenList() and rejects invalid values with HTTP 400 Bad Request. The vulnerable pattern (accepting invali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28-9.0.30 (regression in Transfer-Encoding header parsing). The target version 9.0.75 (released May 2023) contains the upstream fix from December 2019 (commit 060ecc5e by Mark Thomas). The fix validates Transfer-Encoding headers using TokenList.parseTokenList() and rejects invalid values with HTTP 400 Bad Request. The vulnerable pattern (accepting invali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Version 9.0.75 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. While it contains the affected file (Http2UpgradeHandler.java) and method (closeIdleStreams), the implementation uses a semantically equivalent mitigation that prevents the high CPU usage vulnerability. Instead of iterating through all possible stream IDs, it uses ConcurrentNavigableMap.subMap() to efficiently extract only actual streams within the relevant range. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 9.0.75 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. While it contains the affected file (Http2UpgradeHandler.java) and method (closeIdleStreams), the implementation uses a semantically equivalent mitigation that prevents the high CPU usage vulnerability. Instead of iterating through all possible stream IDs, it uses ConcurrentNavigableMap.subMap() to efficiently extract only actual streams within the relevant range. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 9.0.75-tuxcare.7 is not affected by CVE-2020-1935. The vulnerability involved accepting HTTP headers with improper line endings (CR not followed by LF) and control characters in header values, enabling HTTP Request Smuggling. The fix enforcing strict CRLF validation and rejecting control characters (except TAB) was applied by upstream Apache maintainer Mark Thomas in co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.75-tuxcare.7 is not affected by CVE-2020-1935. The vulnerability involved accepting HTTP headers with improper line endings (CR not followed by LF) and control characters in header values, enabling HTTP Request Smuggling. The fix enforcing strict CRLF validation and rejecting control characters (except TAB) was applied by upstream Apache maintainer Mark Thomas in co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Target repository (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2020-1938 (Ghostcat). All three security defenses introduced by the upstream vendor to mitigate this vulnerability are present in the codebase: (1) AJP connector binds to loopback address by default instead of all interfaces, (2) secret authentication is enforced with secretRequired=true by default, and (3) arbitrary request attributes are blocked unless explicitly whitelisted. These fixes were part of the upstream Apache Tomcat 9.0.75 release, which TuxCare onboarded. The vulnerable pattern described in the CVE - where attackers could craft AJP requests to read arbitrary files or execute arbitrary files as JSP - is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "Target repository (Apache Tomcat 9.0.75-tuxcare.7) is not affected by CVE-2020-1938 (Ghostcat). All three security defenses introduced by the upstream vendor to mitigate this vulnerability are present in the codebase: (1) AJP connector binds to loopback address by default instead of all interfaces, (2) secret authentication is enforced with secretRequired=true by default, and (3) arbitrary request attributes are blocked unless explicitly whitelisted. These fixes were part of the upstream Apache Tomcat 9.0.75 release, which TuxCare onboarded. The vulnerable pattern described in the CVE - where attackers could craft AJP requests to read arbitrary files or execute arbitrary files as JSP - is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 affects Apache Tomcat's h2c (HTTP/2 cleartext) connection handling where a shared mutable StringBuilder in HpackDecoder could cause request data leakage between concurrent users. The target repository (Tomcat 9.0.75-tuxcare.7) is NOT AFFECTED because the upstream Apache Tomcat 9.0.75 release already included the fix commits (d56293f816 from 2020-11-09 and d47c20a776 from 2021-01-14) before TuxCare onboarded this version. The vulnerable shared StringBuilder field has been replaced with thread-safe local variables, and the h2c processor lifecycle is properly managed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 affects Apache Tomcat's h2c (HTTP/2 cleartext) connection handling where a shared mutable StringBuilder in HpackDecoder could cause request data leakage between concurrent users. The target repository (Tomcat 9.0.75-tuxcare.7) is NOT AFFECTED because the upstream Apache Tomcat 9.0.75 release already included the fix commits (d56293f816 from 2020-11-09 and d47c20a776 from 2021-01-14) before TuxCare onboarded this version. The vulnerable shared StringBuilder field has been replaced with thread-safe local variables, and the h2c processor lifecycle is properly managed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 is not present in Apache Tomcat 9.0.75. The vulnerability affected versions 9.0.0.M1 to 9.0.41, but the target is version 9.0.75, which already contains the upstream fix. The fix replaces vulnerable string-based path validation (getCanonicalPath().startsWith) with Path-based validation (getCanonicalFile().toPath().startsWith) across all five affected files: DefaultServlet.java, FileStore.java, ContextConfig.java, ExpandWar.java, and HostConfig.java. The fix was introduced by upstream Apache commit 4785433a22 authored by Mark Thomas and was already present in the Apache Tomcat 9.0.75 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 is not present in Apache Tomcat 9.0.75. The vulnerability affected versions 9.0.0.M1 to 9.0.41, but the target is version 9.0.75, which already contains the upstream fix. The fix replaces vulnerable string-based path validation (getCanonicalPath().startsWith) with Path-based validation (getCanonicalFile().toPath().startsWith) across all five affected files: DefaultServlet.java, FileStore.java, ContextConfig.java, ExpandWar.java, and HostConfig.java. The fix was introduced by upstream Apache commit 4785433a22 authored by Mark Thomas and was already present in the Apache Tomcat 9.0.75 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. The target is not affected by CVE-2022-42252. The vulnerability (acceptance of malformed Content-Length headers when rejectIllegalHeader=false) is not present because the upstream Apache Tomcat fix was already included in the release version (9.0.75) that TuxCare onboarded. The fix commit 4c7f4fd09d by Mark Thomas (markt@apache.org) adds special-case logic to always reject malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting, implementing RFC 9112 section 6.3 bullet 5 requirements. This fix is present at Http11InputBuffer.java lines 1038-1043 and predates all TuxCare commits in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "The target is not affected by CVE-2022-42252. The vulnerability (acceptance of malformed Content-Length headers when rejectIllegalHeader=false) is not present because the upstream Apache Tomcat fix was already included in the release version (9.0.75) that TuxCare onboarded. The fix commit 4c7f4fd09d by Mark Thomas (markt@apache.org) adds special-case logic to always reject malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting, implementing RFC 9112 section 6.3 bullet 5 requirements. This fix is present at Http11InputBuffer.java lines 1038-1043 and predates all TuxCare commits in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "action_statement": "Vulnerability CVE-2022-45143 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.75 is not affected by CVE-2023-24998. The vulnerability concerns unlimited file upload parts causing DoS, fixed by adding fileCountMax validation. The fix was implemented by upstream Apache (Mark Thomas, commit cf77cc545de, 2022-12-13) and shipped in Apache Tomcat 9.0.75's upstream release. TuxCare onboarded version 9.0.75 with the fix already present. All fix components exist in the target: FileUploadBase has fileCountMax field/getters/setters and validation check (lines 318-321), Request.java has setFileCountMax integration (line 2862), and FileCountLimitExceededException class exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "Apache Tomcat 9.0.75 is not affected by CVE-2023-24998. The vulnerability concerns unlimited file upload parts causing DoS, fixed by adding fileCountMax validation. The fix was implemented by upstream Apache (Mark Thomas, commit cf77cc545de, 2022-12-13) and shipped in Apache Tomcat 9.0.75's upstream release. TuxCare onboarded version 9.0.75 with the fix already present. All fix components exist in the target: FileUploadBase has fileCountMax field/getters/setters and validation check (lines 318-321), Request.java has setFileCountMax integration (line 2862), and FileCountLimitExceededException class exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 9.0.75 is NOT vulnerable to CVE-2023-28709. The fix for the off-by-one parameter counting vulnerability was already included in the upstream Apache Tomcat 9.0.75 release (tagged May 4, 2023). The fix commit (fbd81421629 by Mark Thomas, April 11, 2023) predates the first TuxCare commit in this repository's history, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "The target Apache Tomcat 9.0.75 is NOT vulnerable to CVE-2023-28709. The fix for the off-by-one parameter counting vulnerability was already included in the upstream Apache Tomcat 9.0.75 release (tagged May 4, 2023). The fix commit (fbd81421629 by Mark Thomas, April 11, 2023) predates the first TuxCare commit in this repository's history, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-34981 describes a regression in bug 66512's fix where HTTP responses with no valid headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The target repository Tomcat 9.0.75-tuxcare.7 contains the upstream fix (bug 66591) authored by Apache committer Mark Thomas (markt@apache.org) on 2023-05-03. The fix was shipped in the upstream Apache Tomcat release that TuxCare onboarded, not applied as a TuxCare backport. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "CVE-2023-34981 describes a regression in bug 66512's fix where HTTP responses with no valid headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The target repository Tomcat 9.0.75-tuxcare.7 contains the upstream fix (bug 66591) authored by Apache committer Mark Thomas (markt@apache.org) on 2023-05-03. The fix was shipped in the upstream Apache Tomcat release that TuxCare onboarded, not applied as a TuxCare backport. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T18:43:00.122669+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 9.0.0-M11 through 9.0.43, where incomplete POST requests could trigger error responses containing data from previous requests by other users. The target repository is at version 9.0.75-tuxcare.7, which is significantly higher than the fixed version 9.0.44. Both required fixes are present in the upstream 9.0.75 release: (1) Http11InputBuffer.java has the try-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 9.0.0-M11 through 9.0.43, where incomplete POST requests could trigger error responses containing data from previous requests by other users. The target repository is at version 9.0.75-tuxcare.7, which is significantly higher than the fixed version 9.0.44. Both required fixes are present in the upstream 9.0.75 release: (1) Http11InputBuffer.java has the try-..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not reuse HTTP/2 request and response objects across streams, preventing the cross-user mix-up. Each stream creates fresh Request and Response objects in java/org/apache/coyote/http2/Stream.java:115. Stream.recycle() only replaces the stream with a RecycledStream and does not reset or return request or response objects to a pool (java/org/apache/coyote/http2/Stream.java:753).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not reuse HTTP/2 request and response objects across streams, preventing the cross-user mix-up. Each stream creates fresh Request and Response objects in java/org/apache/coyote/http2/Stream.java:115. Stream.recycle() only replaces the stream with a RecycledStream and does not reset or return request or response objects to a pool (java/org/apache/coyote/http2/Stream.java:753)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:16:00.156571+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat version 9.0.75 is not affected by CVE-2025-31650. The vulnerability requires HTTP/2 PRIORITY_UPDATE frame handling code (RFC 9218) that was introduced in version 9.0.76. Version 9.0.75 does not implement PRIORITY_UPDATE frames and therefore cannot exhibit the memory leak vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat version 9.0.75 is not affected by CVE-2025-31650. The vulnerability requires HTTP/2 PRIORITY_UPDATE frame handling code (RFC 9218) that was introduced in version 9.0.76. Version 9.0.75 does not implement PRIORITY_UPDATE frames and therefore cannot exhibit the memory leak vulnerability."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:28:57.615729+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.75 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 9.0.114 when TLS 1.3 cipher suite support was added (commit 4ee45c5571, Jan 6 2026), which used a HashSet in getJsseCipherNames() that failed to preserve cipher ordering. Version 9.0.75 predates this feature by 39 minor versions and uses a simpler, non-vulnerable code path that maintains cipher o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.75 is NOT affected by CVE-2026-29129. The vulnerability was introduced in version 9.0.114 when TLS 1.3 cipher suite support was added (commit 4ee45c5571, Jan 6 2026), which used a HashSet in getJsseCipherNames() that failed to preserve cipher ordering. Version 9.0.75 predates this feature by 39 minor versions and uses a simpler, non-vulnerable code path that maintains cipher o..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:16:00.156571+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:16:00.156571+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:00.094795+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 does not affect version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CNA title explicitly scopes this CVE to an HTTP/2 no-authority bypass of strict SNI validation (records/cve.json:1). HTTP/2 requests reach receivedEndOfHeaders(), which lacks the supplied patch\u2019s serverName null check, so the authority hardening is absent (Http2UpgradeHandler.java:1777; Stream.java:508; patches/02-8639b20f045c.patch:20). However, searching java/ found neither checkSni nor strictSni, and the complete HTTP/2 request validator performs syntax checks before calling the adapter without comparing authority against SNI (StreamProcessor.java:470; StreamProcessor.java:424). The TLS path uses SNI to select SSLHostConfig and its certificate, with exact, wildcard, and default configuration lookup (AbstractJsseEndpoint.java:116; AbstractEndpoint.java:482). Request mapping explicitly substitutes the default host when the request host is null (Mapper.java:654).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CNA title explicitly scopes this CVE to an HTTP/2 no-authority bypass of strict SNI validation (records/cve.json:1). HTTP/2 requests reach receivedEndOfHeaders(), which lacks the supplied patch\u2019s serverName null check, so the authority hardening is absent (Http2UpgradeHandler.java:1777; Stream.java:508; patches/02-8639b20f045c.patch:20). However, searching java/ found neither checkSni nor strictSni, and the complete HTTP/2 request validator performs syntax checks before calling the adapter without comparing authority against SNI (StreamProcessor.java:470; StreamProcessor.java:424). The TLS path uses SNI to select SSLHostConfig and its certificate, with exact, wildcard, and default configuration lookup (AbstractJsseEndpoint.java:116; AbstractEndpoint.java:482). Request mapping explicitly substitutes the default host when the request host is null (Mapper.java:654)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:16:00.156571+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.75-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.75-tuxcare.6 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.75-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.75-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}