{
  "@id": "urn:uuid:0810643c-9d33-4d4c-8ffd-1adabda0384c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:17:00.061894+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.87-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.87-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:17:00.061894+00:00",
      "status_notes": "Vulnerability CVE-2001-0590 does not affect version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 CVE-2001-0590 does not affect Tomcat 9.0.87. The vulnerability allowed JSP source code exposure via malformed HTTP requests without protocol specification in Tomcat prior to 3.2.2 (2001). Modern Tomcat's servlet architecture (since 4.x) eliminated this vulnerability class by ensuring all JSP requests are routed through JspServlet for compilation and execution, regardless of HTTP version. While ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2001-0590"
      },
      "impact_statement": "not_affected \u2014 CVE-2001-0590 does not affect Tomcat 9.0.87. The vulnerability allowed JSP source code exposure via malformed HTTP requests without protocol specification in Tomcat prior to 3.2.2 (2001). Modern Tomcat's servlet architecture (since 4.x) eliminated this vulnerability class by ensuring all JSP requests are routed through JspServlet for compilation and execution, regardless of HTTP version. While ..."
    }
  ]
}