{ "@id": "urn:uuid:169bd816-eabf-4aab-afee-9e9dce8ef6d3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 58, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:17:00.447062+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T16:13:53.139556+00:00", "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the 'name' parameter was not escaped before being displayed. The target version (9.0.87) is NOT affected because the upstream vendor (Apache Tomcat) fixed this vulnerability in 2017 by introducing comprehensive HTML escaping via the Escape.htmlElementContent() utility. All user-controlled data, including ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-1947" }, "impact_statement": "not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the 'name' parameter was not escaped before being displayed. The target version (9.0.87) is NOT affected because the upstream vendor (Apache Tomcat) fixed this vulnerability in 2017 by introducing comprehensive HTML escaping via the Escape.htmlElementContent() utility. All user-controlled data, including ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T16:07:05.916705+00:00", "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat's AJP processor handling of requests with Content-Length: 0, causing thread hangs and DoS. The target repository (Apache Tomcat 9.0.87) already contains the upstream fix in java/org/apache/coyote/ajp/AjpProcessor.java at lines 615-617, which properly handles contentLength == 0 by setting endOfStream = true and returning false. This fix was authored by Mark Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0095" }, "impact_statement": "not_affected \u2014 CVE-2014-0095 affects Apache Tomcat's AJP processor handling of requests with Content-Length: 0, causing thread hangs and DoS. The target repository (Apache Tomcat 9.0.87) already contains the upstream fix in java/org/apache/coyote/ajp/AjpProcessor.java at lines 615-617, which properly handles contentLength == 0 by setting endOfStream = true and returning false. This fix was authored by Mark Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.87 is not affected by CVE-2017-12615. The vulnerability affected Tomcat 7.0.0-7.0.79 due to missing canonical path validation in FileDirContext/VirtualDirContext when handling HTTP PUT requests. Tomcat 9.x uses a completely different architecture (WebResource/WebResourceRoot) that includes comprehensive canonical path validation in AbstractFileResourceSet.file() (lines 94-147), which prevents the JSP upload attack. This fix was introduced upstream by Apache maintainers in September 2017 (for CVE-2017-12617, closely related to CVE-2017-12615) and shipped with all Tomcat 9.x releases including 9.0.87. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12615" }, "impact_statement": "Apache Tomcat 9.0.87 is not affected by CVE-2017-12615. The vulnerability affected Tomcat 7.0.0-7.0.79 due to missing canonical path validation in FileDirContext/VirtualDirContext when handling HTTP PUT requests. Tomcat 9.x uses a completely different architecture (WebResource/WebResourceRoot) that includes comprehensive canonical path validation in AbstractFileResourceSet.file() (lines 94-147), which prevents the JSP upload attack. This fix was introduced upstream by Apache maintainers in September 2017 (for CVE-2017-12617, closely related to CVE-2017-12615) and shipped with all Tomcat 9.x releases including 9.0.87. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.87 is not affected by CVE-2017-12617. The vulnerability allowed JSP file upload via specially crafted PUT requests with trailing slashes or invalid Windows characters, exploiting Java File API behavior. The upstream Apache fix (commit b7e0435d17, Sept 2017) shipped in Tomcat 9.0.87's base release, years before TuxCare onboarded this version. All defense mechanisms are present: DirResourceSet.write() rejects paths ending in '/', AbstractFileResourceSet.file() blocks file access for trailing-slash paths, and isInvalidWindowsFilename() validates Windows-specific characters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12617" }, "impact_statement": "Apache Tomcat 9.0.87 is not affected by CVE-2017-12617. The vulnerability allowed JSP file upload via specially crafted PUT requests with trailing slashes or invalid Windows characters, exploiting Java File API behavior. The upstream Apache fix (commit b7e0435d17, Sept 2017) shipped in Tomcat 9.0.87's base release, years before TuxCare onboarded this version. All defense mechanisms are present: DirResourceSet.write() rejects paths ending in '/', AbstractFileResourceSet.file() blocks file access for trailing-slash paths, and isInvalidWindowsFilename() validates Windows-specific characters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.87. The vulnerability involved application listeners receiving internal request/response objects instead of facade objects, allowing untrusted applications running under SecurityManager to retain references and access data across web application boundaries. The upstream fix (commit dfa40863421d7681fed893b4256666491887e38c by Mark Thomas on 2017-03-06) was already present in the Apache Tomcat 9.0.87 release that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() to pass facade objects to fireRequestInitEvent() and fireRequestDestroyEvent() methods, preventing untrusted code from retaining references to internal objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5648" }, "impact_statement": "CVE-2017-5648 is NOT present in Apache Tomcat 9.0.87. The vulnerability involved application listeners receiving internal request/response objects instead of facade objects, allowing untrusted applications running under SecurityManager to retain references and access data across web application boundaries. The upstream fix (commit dfa40863421d7681fed893b4256666491887e38c by Mark Thomas on 2017-03-06) was already present in the Apache Tomcat 9.0.87 release that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() to pass facade objects to fireRequestInitEvent() and fireRequestDestroyEvent() methods, preventing untrusted code from retaining references to internal objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 (sendfile race condition causing processor reuse) is NOT present in target version 9.0.87. The fix was introduced in upstream Apache Tomcat 9.0.0-M19 (March 2017) by commit 9233d9d6a0 (Mark Thomas, markt@apache.org). The vulnerable pattern (breakKeepAliveLoop method checking sendfileData != null) does not exist; the fixed implementation (processSendfile with SendfileState tracking) is present throughout the codebase. The fix shipped in the upstream release before TuxCare's setup commit cfbc8da6fa.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5651" }, "impact_statement": "CVE-2017-5651 (sendfile race condition causing processor reuse) is NOT present in target version 9.0.87. The fix was introduced in upstream Apache Tomcat 9.0.0-M19 (March 2017) by commit 9233d9d6a0 (Mark Thomas, markt@apache.org). The vulnerable pattern (breakKeepAliveLoop method checking sendfileData != null) does not exist; the fixed implementation (processSendfile with SendfileState tracking) is present throughout the codebase. The fix shipped in the upstream release before TuxCare's setup commit cfbc8da6fa.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 does not affect Tomcat 9.0.87. The vulnerability involves protocol-relative redirect generation in the DefaultServlet when redirecting to directories. The fix (stripping consecutive leading slashes) was committed by upstream Apache on Sep 4, 2018 (commit efb860b3ff) and shipped in upstream release 9.0.12. Since the target version 9.0.87 is well beyond the affected range (9.0.0.M1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11784" }, "impact_statement": "not_affected \u2014 CVE-2018-11784 does not affect Tomcat 9.0.87. The vulnerability involves protocol-relative redirect generation in the DefaultServlet when redirecting to directories. The fix (stripping consecutive leading slashes) was committed by upstream Apache on Sep 4, 2018 (commit efb860b3ff) and shipped in upstream release 9.0.12. Since the target version 9.0.87 is well beyond the affected range (9.0.0.M1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-02T14:34:20.745821+00:00", "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target (Tomcat 9.0.87) is not affected by CVE-2018-1304. The vulnerability, which allowed unauthorized access to web application resources protected by security constraints with an empty string URL pattern (\"\"), was fixed in the upstream Apache Tomcat project. The fix was already present in version 9.0.87 when TuxCare adopted it. The vulnerable pattern matching logic has been corrected in R...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1304" }, "impact_statement": "not_affected \u2014 The target (Tomcat 9.0.87) is not affected by CVE-2018-1304. The vulnerability, which allowed unauthorized access to web application resources protected by security constraints with an empty string URL pattern (\"\"), was fixed in the upstream Apache Tomcat project. The fix was already present in version 9.0.87 when TuxCare adopted it. The vulnerable pattern matching logic has been corrected in R..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Tomcat 9.0.87 is NOT affected by CVE-2018-1305. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied too late (at servlet load time rather than application start), creating a timing window where some resources could be accessed without authorization. The fix (commit 3e54b2a631) was already present in the upstream Tomcat 9.0.87 release ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1305" }, "impact_statement": "not_affected \u2014 The target Tomcat 9.0.87 is NOT affected by CVE-2018-1305. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied too late (at servlet load time rather than application start), creating a timing window where some resources could be accessed without authorization. The fix (commit 3e54b2a631) was already present in the upstream Tomcat 9.0.87 release ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 is not present in Tomcat 9.0.87. The vulnerability affected versions 9.0.0.M9 to 9.0.7, and the upstream fix from April 2018 (commit 92cd494555598e99dd691712e8ee426a2f9c2e93) was already included in the 9.0.87 upstream release that TuxCare onboarded. The fix adds proper input position reset logic when the UTF-8 decoder encounters an output buffer overflow while processing 4-byte supplementary characters, preventing the infinite loop that would cause DoS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1336" }, "impact_statement": "CVE-2018-1336 is not present in Tomcat 9.0.87. The vulnerability affected versions 9.0.0.M9 to 9.0.7, and the upstream fix from April 2018 (commit 92cd494555598e99dd691712e8ee426a2f9c2e93) was already included in the 9.0.87 upstream release that TuxCare onboarded. The fix adds proper input position reset logic when the UTF-8 decoder encounters an output buffer overflow while processing 4-byte supplementary characters, preventing the infinite loop that would cause DoS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014: The target Apache Tomcat 9.0.87 is NOT AFFECTED. The vulnerability concerning insecure CORS filter defaults (allowing supportsCredentials=true for all origins) was fixed in the upstream Apache Tomcat release by commit d83a76732e (author: markt@apache.org, dated May 16, 2018). This fix was already present in the upstream Tomcat 9.0.87 release that TuxCare onboarded. All three fix components are verified present in the target code: (1) DEFAULT_ALLOWED_ORIGINS=\"\" instead of \"*\", (2) DEFAULT_SUPPORTS_CREDENTIALS=\"false\" instead of \"true\", and (3) validation preventing the dangerous combination. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8014" }, "impact_statement": "CVE-2018-8014: The target Apache Tomcat 9.0.87 is NOT AFFECTED. The vulnerability concerning insecure CORS filter defaults (allowing supportsCredentials=true for all origins) was fixed in the upstream Apache Tomcat release by commit d83a76732e (author: markt@apache.org, dated May 16, 2018). This fix was already present in the upstream Tomcat 9.0.87 release that TuxCare onboarded. All three fix components are verified present in the target code: (1) DEFAULT_ALLOWED_ORIGINS=\"\" instead of \"*\", (2) DEFAULT_SUPPORTS_CREDENTIALS=\"false\" instead of \"true\", and (3) validation preventing the dangerous combination. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034: The target Tomcat 9.0.87 is NOT AFFECTED. The vulnerability (missing hostname verification in WebSocket TLS client connections) was fixed in upstream Tomcat and included in the 9.0.87 release that TuxCare onboarded. The fix at WsWebSocketContainer.java:929-935 unconditionally enables hostname verification by setting SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\") for all WebSocket TLS connections. Fix commit 2835bb4e030c1c741ed0847bb3b9c3822e4fbc8a by Mark Thomas (markt@apache.org) from June 18, 2018 is an ancestor of the first TuxCare commit cfbc8da6fabd3c0af4415e35c126d13d1325fa94.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8034" }, "impact_statement": "CVE-2018-8034: The target Tomcat 9.0.87 is NOT AFFECTED. The vulnerability (missing hostname verification in WebSocket TLS client connections) was fixed in upstream Tomcat and included in the 9.0.87 release that TuxCare onboarded. The fix at WsWebSocketContainer.java:929-935 unconditionally enables hostname verification by setting SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\") for all WebSocket TLS connections. Fix commit 2835bb4e030c1c741ed0847bb3b9c3822e4fbc8a by Mark Thomas (markt@apache.org) from June 18, 2018 is an ancestor of the first TuxCare commit cfbc8da6fabd3c0af4415e35c126d13d1325fa94.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T01:24:43.245442+00:00", "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 affects Apache Tomcat versions 9.0.0.M9 to 9.0.9. The target is version 9.0.87, which is significantly newer and already contains both upstream fixes: (1) generation tracking to prevent stale async timeout processing, and (2) improved connection closure tracking via AtomicBoolean refactoring. Both fixes were authored by upstream Apache developers and shipped in the 9.0.87 release ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8037" }, "impact_statement": "not_affected \u2014 CVE-2018-8037 affects Apache Tomcat versions 9.0.0.M9 to 9.0.9. The target is version 9.0.87, which is significantly newer and already contains both upstream fixes: (1) generation tracking to prevent stale async timeout processing, and (2) improved connection closure tracking via AtomicBoolean refactoring. Both fixes were authored by upstream Apache developers and shipped in the 9.0.87 release ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.87 is NOT affected by CVE-2019-0199. The vulnerability affected versions 9.0.0.M1 to 9.0.14 (and 8.5.0 to 8.5.37). The fix was applied by upstream Apache Tomcat maintainer Mark Thomas on 2019-02-01 and shipped in version 9.0.15. The target version 9.0.87 (released March 2024) includes the complete fix, which consists of: (1) stream-level read/write timeouts preventing threads from blocking indefinitely when clients stop reading/writing, and (2) overhead frame tracking that closes connections sending excessive non-productive frames (SETTINGS, PRIORITY, PING). Both defense mechanisms are present and active in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0199" }, "impact_statement": "Apache Tomcat 9.0.87 is NOT affected by CVE-2019-0199. The vulnerability affected versions 9.0.0.M1 to 9.0.14 (and 8.5.0 to 8.5.37). The fix was applied by upstream Apache Tomcat maintainer Mark Thomas on 2019-02-01 and shipped in version 9.0.15. The target version 9.0.87 (released March 2024) includes the complete fix, which consists of: (1) stream-level read/write timeouts preventing threads from blocking indefinitely when clients stop reading/writing, and (2) overhead frame tracking that closes connections sending excessive non-productive frames (SETTINGS, PRIORITY, PING). Both defense mechanisms are present and active in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 is not present in target Tomcat 9.0.87. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache commit 15fcd166 on 2019-04-09, which added HTML entity encoding to the printenv output. This fix was already present in the upstream 9.0.87 release when TuxCare onboarded it. The current code at SSIPrintenv.java:44 uses getVariableValue(varia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0221" }, "impact_statement": "not_affected \u2014 CVE-2019-0221 is not present in target Tomcat 9.0.87. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache commit 15fcd166 on 2019-04-09, which added HTML entity encoding to the printenv output. This fix was already present in the upstream 9.0.87 release when TuxCare onboarded it. The current code at SSIPrintenv.java:44 uses getVariableValue(varia..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 9.0.87 is not affected by CVE-2019-0232. The vulnerability affected versions up to 9.0.17, and the fix was included in upstream release 9.0.18 (April 2019). Target version 9.0.87 includes the fix in its baseline - the decoded command line argument validation is present at CGIServlet.java:752-759. The vulnerable code pattern (lack of decoded argument validation before passing to OS commands) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0232" }, "impact_statement": "Target Apache Tomcat 9.0.87 is not affected by CVE-2019-0232. The vulnerability affected versions up to 9.0.17, and the fix was included in upstream release 9.0.18 (April 2019). Target version 9.0.87 includes the fix in its baseline - the decoded command line argument validation is present at CGIServlet.java:752-759. The vulnerable code pattern (lack of decoded argument validation before passing to OS commands) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 9.0.87 is NOT AFFECTED by CVE-2019-10072. The vulnerability involves HTTP/2 connection window exhaustion causing indefinite thread blocking. The upstream fix by Mark Thomas (commit 7f748eb6) was already present in Tomcat 9.0.87 before TuxCare onboarded this version. The fix adds timeout-based waiting to connection window allocation in Http2UpgradeHandler.reserveWindowSize() (lines 1000-1028), preventing indefinite thread blocking when connection flow control window is exhausted. After timeout without allocation, the connection is closed and stream is cancelled, preventing DoS. The vulnerable pattern (indefinite wait) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10072" }, "impact_statement": "Target Tomcat 9.0.87 is NOT AFFECTED by CVE-2019-10072. The vulnerability involves HTTP/2 connection window exhaustion causing indefinite thread blocking. The upstream fix by Mark Thomas (commit 7f748eb6) was already present in Tomcat 9.0.87 before TuxCare onboarded this version. The fix adds timeout-based waiting to connection window allocation in Http2UpgradeHandler.reserveWindowSize() (lines 1000-1028), preventing indefinite thread blocking when connection flow control window is exhausted. After timeout without allocation, the connection is closed and stream is cancelled, preventing DoS. The vulnerable pattern (indefinite wait) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 9.0.87 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was completely removed from upstream Apache Tomcat in commit 510520cf49 (January 11, 2022), which predates TuxCare's onboarding of version 9.0.87. The component that allowed local attackers to manipulate the RMI registry for MITM credential capture no longer exists in the target codebase. This is an upstream fix that was already present in the 9.0.87 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12418" }, "impact_statement": "Target Tomcat 9.0.87 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was completely removed from upstream Apache Tomcat in commit 510520cf49 (January 11, 2022), which predates TuxCare's onboarding of version 9.0.87. The component that allowed local attackers to manipulate the RMI registry for MITM credential capture no longer exists in the target codebase. This is an upstream fix that was already present in the 9.0.87 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.87 is not affected by CVE-2019-17563 (FORM authentication session fixation). The vulnerability affected versions 9.0.0.M1 to 9.0.29, and the fix shipped with upstream Apache Tomcat before version 9.0.87 was released. All fix indicators are present: checkForCachedAuthentication() is called after the matching request check, matchRequest() checks session.getPrincipal() or request.getPrincipal() instead of session notes, and the deprecated FORM_PRINCIPAL_NOTE is never set. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17563" }, "impact_statement": "Tomcat 9.0.87 is not affected by CVE-2019-17563 (FORM authentication session fixation). The vulnerability affected versions 9.0.0.M1 to 9.0.29, and the fix shipped with upstream Apache Tomcat before version 9.0.87 was released. All fix indicators are present: checkForCachedAuthentication() is called after the matching request check, matchRequest() checks session.getPrincipal() or request.getPrincipal() instead of session notes, and the deprecated FORM_PRINCIPAL_NOTE is never set. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T16:24:56.766712+00:00", "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 9.0.87. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, leading to potential HTTP Request Smuggling. The fix (commit 060ecc5eb8) was applied by upstream Apache on 2019-12-17 and is present in the 9.0.87 release that TuxCare onboarded. The current code properly validate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17569" }, "impact_statement": "not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 9.0.87. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, leading to potential HTTP Request Smuggling. The fix (commit 060ecc5eb8) was applied by upstream Apache on 2019-12-17 and is present in the 9.0.87 release that TuxCare onboarded. The current code properly validate..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Version 9.0.87 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed and further optimized. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11996" }, "impact_statement": "Version 9.0.87 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed and further optimized. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 fix was applied by upstream Apache Tomcat in the 9.0.87 release. The vulnerability involved lax HTTP header parsing that could enable request smuggling. The vendor applied a two-phase fix: (1) Jan 2020 commit 8bfb0ff7f2 added strict CRLF parsing and control character rejection; (2) April 2021 commit 70c236bab5 (BZ 65272) refined the fix to accept lone LF as valid while keeping con...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-1935" }, "impact_statement": "not_affected \u2014 CVE-2020-1935 fix was applied by upstream Apache Tomcat in the 9.0.87 release. The vulnerability involved lax HTTP header parsing that could enable request smuggling. The vendor applied a two-phase fix: (1) Jan 2020 commit 8bfb0ff7f2 added strict CRLF parsing and control character rejection; (2) April 2021 commit 70c236bab5 (BZ 65272) refined the fix to accept lone LF as valid while keeping con..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 9.0.87 is not affected by CVE-2020-1938 (Ghostcat). The vulnerability was fixed in upstream Apache Tomcat 9.0.31 (January 2020), 56 releases before the target version. All security defenses are present and active by default: (1) AJP binds to loopback only, (2) secret authentication required (secretRequired=true), (3) arbitrary request attributes blocked with 403, (4) AJP connector commented out in default configuration. The fix commit (0e8a50f0) authored by markt@apache.org was already in the upstream release before TuxCare onboarded version 9.0.87.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-1938" }, "impact_statement": "Target Apache Tomcat 9.0.87 is not affected by CVE-2020-1938 (Ghostcat). The vulnerability was fixed in upstream Apache Tomcat 9.0.31 (January 2020), 56 releases before the target version. All security defenses are present and active by default: (1) AJP binds to loopback only, (2) secret authentication required (secretRequired=true), (3) arbitrary request attributes blocked with 403, (4) AJP connector commented out in default configuration. The fix commit (0e8a50f0) authored by markt@apache.org was already in the upstream release before TuxCare onboarded version 9.0.87.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9484" }, "impact_statement": "Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-24122 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-24122" }, "impact_statement": "CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-25122 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.87 is not affected by CVE-2021-25122. The vulnerability affected versions 9.0.0.M1 to 9.0.41 and was fixed in the upstream release. The target version 9.0.87 includes the complete fix: HpackDecoder uses local StringBuilder instances instead of a shared field, and AbstractProtocol properly handles processor recycling for h2c connections. The fix was authored by Mark Thomas (Apache) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-25122" }, "impact_statement": "Apache Tomcat 9.0.87 is not affected by CVE-2021-25122. The vulnerability affected versions 9.0.0.M1 to 9.0.41 and was fixed in the upstream release. The target version 9.0.87 includes the complete fix: HpackDecoder uses local StringBuilder instances instead of a shared field, and AbstractProtocol properly handles processor recycling for h2c connections. The fix was authored by Mark Thomas (Apache) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2021-25329 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 describes an incomplete fix for CVE-2020-9484, involving directory traversal vulnerabilities due to inadequate path containment checks using String-based comparison. The target Apache Tomcat 9.0.87 (commit aaf8274a60) is NOT affected because the vulnerable pattern (getCanonicalPath().startsWith()) does not exist in the codebase. All five affected files use the fixed pattern (java.nio.file.Path.startsWith()). The fix was authored by Apache upstream maintainer Mark Thomas on January 20, 2021 and was already included in the Apache Tomcat 9.0.87 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-25329" }, "impact_statement": "CVE-2021-25329 describes an incomplete fix for CVE-2020-9484, involving directory traversal vulnerabilities due to inadequate path containment checks using String-based comparison. The target Apache Tomcat 9.0.87 (commit aaf8274a60) is NOT affected because the vulnerable pattern (getCanonicalPath().startsWith()) does not exist in the codebase. All five affected files use the fixed pattern (java.nio.file.Path.startsWith()). The fix was authored by Apache upstream maintainer Mark Thomas on January 20, 2021 and was already included in the Apache Tomcat 9.0.87 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T11:42:00.511362+00:00", "status_notes": "Vulnerability CVE-2022-42252 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 is not present in Apache Tomcat 9.0.87. The vulnerability (accepting malformed Content-Length headers when rejectIllegalHeader is disabled) was fixed by upstream Apache in commit 4c7f4fd09d2cc1692112ef70b8ee23a7a037ae77 (October 2022) before this version was released. The fix adds special handling in Http11InputBuffer.skipLine() that forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader setting, implementing RFC 9112 section 6.3 bullet 5. The defense code is present at lines 1031-1048 of Http11InputBuffer.java in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42252" }, "impact_statement": "CVE-2022-42252 is not present in Apache Tomcat 9.0.87. The vulnerability (accepting malformed Content-Length headers when rejectIllegalHeader is disabled) was fixed by upstream Apache in commit 4c7f4fd09d2cc1692112ef70b8ee23a7a037ae77 (October 2022) before this version was released. The fix adds special handling in Http11InputBuffer.skipLine() that forces rejection of malformed Content-Length headers regardless of the rejectIllegalHeader setting, implementing RFC 9112 section 6.3 bullet 5. The defense code is present at lines 1031-1048 of Http11InputBuffer.java in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T11:41:21.668205+00:00", "status_notes": "Vulnerability CVE-2023-24998 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.87 is not affected by CVE-2023-24998. The fix for limiting the number of multipart request parts was already present in the upstream Tomcat 9.0.87 release that TuxCare onboarded. The fix commit (cf77cc545de by Mark Thomas) predates the first TuxCare commit, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-24998" }, "impact_statement": "Apache Tomcat 9.0.87 is not affected by CVE-2023-24998. The fix for limiting the number of multipart request parts was already present in the upstream Tomcat 9.0.87 release that TuxCare onboarded. The fix commit (cf77cc545de by Mark Thomas) predates the first TuxCare commit, confirming it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2023-28709 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 is not present in Tomcat 9.0.87. The vulnerability was an off-by-one error in Parameters.addParameter() where parameterCount was incremented BEFORE checking the limit, allowing exactly one parameter over maxParameterCount to be processed. The upstream fix (commit fbd81421629, Mark Thomas, April 2023) moved the limit check before the increment and changed the comparison from '>' to '>='. This fix was already included in Apache Tomcat 9.0.74 and is present in the 9.0.87 release that TuxCare onboarded. The target code at java/org/apache/tomcat/util/http/Parameters.java:204-210 shows the correct fixed pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-28709" }, "impact_statement": "CVE-2023-28709 is not present in Tomcat 9.0.87. The vulnerability was an off-by-one error in Parameters.addParameter() where parameterCount was incremented BEFORE checking the limit, allowing exactly one parameter over maxParameterCount to be processed. The upstream fix (commit fbd81421629, Mark Thomas, April 2023) moved the limit check before the increment and changed the comparison from '>' to '>='. This fix was already included in Apache Tomcat 9.0.74 and is present in the 9.0.87 release that TuxCare onboarded. The target code at java/org/apache/tomcat/util/http/Parameters.java:204-210 shows the correct fixed pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2023-34981 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-34981 describes a regression in the fix for bug 66512 where HTTP responses with no headers would fail to send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The target repository (Apache Tomcat 9.0.87) contains the fix for this vulnerability, which was included in upstream release 9.0.75. The fix (commit 2f0ca2378415f4cf0748f4bc8fa955f41f803fa5 by Mark Thomas, May 3, 2023) restructured the prepareResponse() method to ensure SEND_HEADERS is always sent before processing headers, preventing the information leak even when responses contain zero headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34981" }, "impact_statement": "CVE-2023-34981 describes a regression in the fix for bug 66512 where HTTP responses with no headers would fail to send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The target repository (Apache Tomcat 9.0.87) contains the fix for this vulnerability, which was included in upstream release 9.0.75. The fix (commit 2f0ca2378415f4cf0748f4bc8fa955f41f803fa5 by Mark Thomas, May 3, 2023) restructured the prepareResponse() method to ensure SEND_HEADERS is always sent before processing headers, preventing the information leak even when responses contain zero headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-10-30T00:49:00.093458+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T11:39:32.418284+00:00", "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in Apache Tomcat 9.0.87. The vulnerability pattern (unbounded RST_STREAM frame processing causing resource exhaustion) was already fixed in the upstream Apache Tomcat 9.0.87 release before TuxCare onboarded this version. The fix implements rate-limiting of RST_STREAM frames via an overhead counter mechanism that closes connections when the reset rate exceeds configured thresholds.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-44487" }, "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in Apache Tomcat 9.0.87. The vulnerability pattern (unbounded RST_STREAM frame processing causing resource exhaustion) was already fixed in the upstream Apache Tomcat 9.0.87 release before TuxCare onboarded this version. The fix implements rate-limiting of RST_STREAM frames via an overhead counter mechanism that closes connections when the reset rate exceeds configured thresholds.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T11:40:00.069704+00:00", "status_notes": "Vulnerability CVE-2023-46589 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.87 is NOT AFFECTED by CVE-2023-46589. The vulnerability concerns improper HTTP trailer header parsing that could lead to request smuggling. The CVE advisory states versions 9.0.0-9.0.82 are affected, with 9.0.83+ containing the fix. The target version 9.0.87 already contains the upstream vendor fix (commit 59583245 by Mark Thomas) that validates trailer header names for token characters and values for control characters. This fix was included in the upstream Apache Tomcat 9.0.87 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-46589" }, "impact_statement": "Apache Tomcat 9.0.87 is NOT AFFECTED by CVE-2023-46589. The vulnerability concerns improper HTTP trailer header parsing that could lead to request smuggling. The CVE advisory states versions 9.0.0-9.0.82 are affected, with 9.0.83+ containing the fix. The target version 9.0.87 already contains the upstream vendor fix (commit 59583245 by Mark Thomas) that validates trailer header names for token characters and values for control characters. This fix was included in the upstream Apache Tomcat 9.0.87 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-02T18:42:01.819471+00:00", "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability affects versions 9.0.0-M11 through 9.0.43, with fixes released in 9.0.44+. The target version (9.0.87) includes upstream fixes from commits d1da266aa1 (ErrorReportValve) and ce4b154e7b (Http11InputBuffer), both authored by Mark Thomas and shipped in the upstream release. The vulnerable pattern\u2014unconditional error inform...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21733" }, "impact_statement": "not_affected \u2014 CVE-2024-21733 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability affects versions 9.0.0-M11 through 9.0.43, with fixes released in 9.0.44+. The target version (9.0.87) includes upstream fixes from commits d1da266aa1 (ErrorReportValve) and ce4b154e7b (Http11InputBuffer), both authored by Mark Thomas and shipped in the upstream release. The vulnerable pattern\u2014unconditional error inform..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24549 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-24549 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability (DoS via delayed HTTP/2 header validation) was fixed by upstream Apache in version 9.0.86 (commit 8e03be9f2698f2da9027d40b9e9c0c9429b74dc0 by Mark Thomas). TuxCare's 9.0.87-tuxcare.6 inherited this fix from upstream 9.0.87, which already contained the vendor fix. No TuxCare backport was required.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24549" }, "impact_statement": "CVE-2024-24549 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability (DoS via delayed HTTP/2 header validation) was fixed by upstream Apache in version 9.0.86 (commit 8e03be9f2698f2da9027d40b9e9c0c9429b74dc0 by Mark Thomas). TuxCare's 9.0.87-tuxcare.6 inherited this fix from upstream 9.0.87, which already contained the vendor fix. No TuxCare backport was required." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-34750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-50379" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T16:34:22.136729+00:00", "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-52317 affects Apache Tomcat 9.0.92-9.0.95 where premature/duplicate recycling of HTTP/2 request/response objects can cause data mix-up between users. The target version 9.0.87 predates the vulnerability-introducing commit (87735635aa, August 2024) and lacks the vulnerable code pattern. The target's Stream.recycle() method (lines 787-800) only performs memory optimization via handler.re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52317" }, "impact_statement": "not_affected \u2014 CVE-2024-52317 affects Apache Tomcat 9.0.92-9.0.95 where premature/duplicate recycling of HTTP/2 request/response objects can cause data mix-up between users. The target version 9.0.87 predates the vulnerability-introducing commit (87735635aa, August 2024) and lacks the vulnerable code pattern. The target's Stream.recycle() method (lines 787-800) only performs memory optimization via handler.re..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56337 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-56337" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-24813" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31651" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-46701" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48988 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.87-tuxcare.5.", "vulnerability": { "name": "CVE-2025-48988" }, "action_statement": "Vulnerability CVE-2025-48988 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.87-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49124" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49125" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52520 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52520" }, "action_statement": "Vulnerability CVE-2025-52520 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55668" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55752" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55754" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.87-tuxcare.6.", "vulnerability": { "name": "CVE-2026-25854" }, "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.87-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-03T16:30:36.061493+00:00", "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.87 is not affected by CVE-2026-29129. The CVE affects only versions 9.0.114-9.0.115, indicating a regression introduced in 9.0.114 and fixed in 9.0.116. Version 9.0.87 is 27 minor versions older than the affected range. Code analysis confirms that cipher ordering is correctly implemented in 9.0.87: the honorCipherOrder configuration is properly applied via SSLParameters.setUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29129" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.87 is not affected by CVE-2026-29129. The CVE affects only versions 9.0.114-9.0.115, indicating a regression introduced in 9.0.114 and fixed in 9.0.116. Version 9.0.87 is 27 minor versions older than the affected range. Code analysis confirms that cipher ordering is correctly implemented in 9.0.87: the honorCipherOrder configuration is properly applied via SSLParameters.setUse..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.87-tuxcare.6.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.87-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T16:52:53.138657+00:00", "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-53404" }, "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T16:48:00.070829+00:00", "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55276" }, "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T16:25:24.528819+00:00", "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55956" }, "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-04T16:31:00.070810+00:00", "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55957" }, "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2026-65637 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the strict SNI validation mechanism targeted by this vulnerability. Neither strictSni nor checkSni exists in this code; the SNI lookup only selects an SSL configuration (java/org/apache/tomcat/util/net/AbstractEndpoint.java:499), and requests without a hostname use the configured default host (java/org/apache/catalina/mapper/Mapper.java:656).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-65637" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the strict SNI validation mechanism targeted by this vulnerability. Neither strictSni nor checkSni exists in this code; the SNI lookup only selects an SSL configuration (java/org/apache/tomcat/util/net/AbstractEndpoint.java:499), and requests without a hostname use the configured default host (java/org/apache/catalina/mapper/Mapper.java:656)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.87-tuxcare.3" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.87-tuxcare.3.", "vulnerability": { "name": "GHSA-r53m-pfr5-7v87" }, "impact_statement": "The vulnerability has been withdrawn." } ] }