{
  "@id": "urn:uuid:0bd2dfac-bfa9-4a71-8445-da8415afc5ca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 57,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:42:00.103673+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the \"name\" parameter was rendered without HTML escaping. The target (Tomcat 8.5.100) is NOT affected because the vulnerability was fixed by upstream Apache Tomcat in 2008, and this fix was already present in the upstream release when TuxCare adopted it. The code properly escapes all user-controlled...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the \"name\" parameter was rendered without HTML escaping. The target (Tomcat 8.5.100) is NOT affected because the vulnerability was fixed by upstream Apache Tomcat in 2008, and this fix was already present in the upstream release when TuxCare adopted it. The code properly escapes all user-controlled..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T23:29:00.040141+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XML External Entity vulnerability) is NOT present in Apache Tomcat 8.5.100. The upstream fix (commit 78dd7e6f3d8481bc3bcd71ca5b20296de1283888 by Mark Thomas, Dec 2013) was already included in the Apache Tomcat release before TuxCare onboarded this version. The fix adds blockExternal protection throughout XML parsing infrastructure: LocalResolver throws FileNotFoundException for e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4590 (XML External Entity vulnerability) is NOT present in Apache Tomcat 8.5.100. The upstream fix (commit 78dd7e6f3d8481bc3bcd71ca5b20296de1283888 by Mark Thomas, Dec 2013) was already included in the Apache Tomcat release before TuxCare onboarded this version. The fix adds blockExternal protection throughout XML parsing infrastructure: LocalResolver throws FileNotFoundException for e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T23:20:30.247395+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is not present in the target. The vulnerability allowed directory traversal via patterns like `/..`, `//../`, and `/./.` that could bypass SecurityManager restrictions. The upstream Apache Tomcat fix (commit 78688b0a30 by Mark Thomas) was already included in the release that TuxCare onboarded. The current HEAD implements the protection using a refactored approach (trailing-slash t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5174 is not present in the target. The vulnerability allowed directory traversal via patterns like `/..`, `//../`, and `/./.` that could bypass SecurityManager restrictions. The upstream Apache Tomcat fix (commit 78688b0a30 by Mark Thomas) was already included in the release that TuxCare onboarded. The current HEAD implements the protection using a refactored approach (trailing-slash t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:42:00.103673+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. No affected range in the advisories covers version 8.5.100. Advisories: GitHub GHSA-jrcp-c39h-r29x (no listed range covers this version), NVD (no listed range covers this version).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. No affected range in the advisories covers version 8.5.100. Advisories: GitHub GHSA-jrcp-c39h-r29x (no listed range covers this version), NVD (no listed range covers this version)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T23:23:31.441488+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 The target is not affected by CVE-2016-0706. The fix (adding StatusManagerServlet to the restricted servlets list) was already present in the upstream Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix was committed by the Apache Tomcat project (markt@apache.org) on 2016-01-04, approximately 9 years before TuxCare's first commit on 2025-05-07. The vulnerable pattern (StatusManagerSer...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "impact_statement": "not_affected \u2014 The target is not affected by CVE-2016-0706. The fix (adding StatusManagerServlet to the restricted servlets list) was already present in the upstream Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix was committed by the Apache Tomcat project (markt@apache.org) on 2016-01-04, approximately 9 years before TuxCare's first commit on 2025-05-07. The vulnerable pattern (StatusManagerSer..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-0762 timing attack vulnerability has been mitigated in this Apache Tomcat 8.5.100 repository. The fix adds password processing even when usernames don't exist, preventing timing-based user enumeration attacks in basic authentication.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-0762 timing attack vulnerability has been mitigated in this Apache Tomcat 8.5.100 repository. The fix adds password processing even when usernames don't exist, preventing timing-based user enumeration attacks in basic authentication."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-0763 affects Apache Tomcat 8.x before 8.0.31",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "impact_statement": "CVE-2016-0763 affects Apache Tomcat 8.x before 8.0.31"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-6794 affects Apache Tomcat 8.5.0-8.5.4",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "impact_statement": "CVE-2016-6794 affects Apache Tomcat 8.5.0-8.5.4"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-6796 is NOT present in this target. The target repository is Apache Tomcat 8.5.100-tuxcare.10, which is significantly higher than the affected version range (8.5.0 to 8.5.4). The security fix that prevents SecurityManager bypass via JSP Servlet configuration manipulation is present in the code at JspServlet.java lines 92-96.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-6796 is NOT present in this target. The target repository is Apache Tomcat 8.5.100-tuxcare.10, which is significantly higher than the affected version range (8.5.0 to 8.5.4). The security fix that prevents SecurityManager bypass via JSP Servlet configuration manipulation is present in the code at JspServlet.java lines 92-96."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-6797 has been fixed in this repository. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was introduced in commit d6b5600afe (August 22, 2016) and implements an allowlist-based access control mechanism in ResourceLinkFactory.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-6797 has been fixed in this repository. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was introduced in commit d6b5600afe (August 22, 2016) and implements an allowlist-based access control mechanism in ResourceLinkFactory."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-6817 affects Apache Tomcat 8.5.0 to 8.5.6 and 9.0.0.M1 to 9.0.0.M11. The target repository is version 8.5.100-tuxcare.10, which already contains the fix that was applied in commit ee091b16f4 on October 20, 2016. The fix implements header size and count limits with exception throwing to prevent the infinite loop vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-6817 affects Apache Tomcat 8.5.0 to 8.5.6 and 9.0.0.M1 to 9.0.0.M11. The target repository is version 8.5.100-tuxcare.10, which already contains the fix that was applied in commit ee091b16f4 on October 20, 2016. The fix implements header size and count limits with exception throwing to prevent the infinite loop vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-8747 is NOT present in the target repository. The target is Apache Tomcat 8.5.100-tuxcare.10, which already contains the fix introduced in version 8.5.10 (December 2016). The vulnerable buffer management code in the nextRequest() method has been replaced with proper buffer state handling that prevents cross-request data leakage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-8747 is NOT present in the target repository. The target is Apache Tomcat 8.5.100-tuxcare.10, which already contains the fix introduced in version 8.5.10 (December 2016). The vulnerable buffer management code in the nextRequest() method has been replaced with proper buffer state handling that prevents cross-request data leakage."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat 8.5.0-8.5.12",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "impact_statement": "CVE-2017-5647 affects Apache Tomcat 8.5.0-8.5.12"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2017-5650 affects Apache Tomcat 8.5.0 to 8.5.12. The target repository is running Tomcat 8.5.100-tuxcare.10, which is 88 minor versions beyond the affected range. Code analysis confirms the fix is present: when a GOAWAY frame is received, all streams including those waiting for WINDOW_UPDATE are properly closed and their threads are released, preventing thread exhaustion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-5650 affects Apache Tomcat 8.5.0 to 8.5.12. The target repository is running Tomcat 8.5.100-tuxcare.10, which is 88 minor versions beyond the affected range. Code analysis confirms the fix is present: when a GOAWAY frame is received, all streams including those waiting for WINDOW_UPDATE are properly closed and their threads are released, preventing thread exhaustion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 The target repository (Apache Tomcat 8.5.100-tuxcare.10) already contains the fix for CVE-2017-5664. The DefaultServlet.service() method forces all error-dispatched requests to be processed as GET requests, preventing PUT/DELETE operations on static error pages.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Apache Tomcat 8.5.100-tuxcare.10) already contains the fix for CVE-2017-5664. The DefaultServlet.service() method forces all error-dispatched requests to be processed as GET requests, preventing PUT/DELETE operations on static error pages."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2017-7674 has already been fixed in this Tomcat version. The CORS Filter now correctly adds the HTTP Vary header when specific origins are configured, preventing cache poisoning attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-7674 has already been fixed in this Tomcat version. The CORS Filter now correctly adds the HTTP Vary header when specific origins are configured, preventing cache poisoning attacks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation (versions 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21), allowing directory traversal attacks via specially crafted URLs. The target repository (Tomcat 8.5.100-tuxcare.10) already contains the fix for this vulnerability, applied via Bug 61120 in May 2017.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation (versions 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21), allowing directory traversal attacks via specially crafted URLs. The target repository (Tomcat 8.5.100-tuxcare.10) already contains the fix for this vulnerability, applied via Bug 61120 in May 2017."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat 8.5.0 to 8.5.39. The target version is 8.5.100, which is 61 minor versions beyond the affected range. The vulnerability (unescaped output in SSI printenv command) has been fixed in the target code. The file java/org/apache/catalina/ssi/SSIPrintenv.java line 44 uses `ssiMediator.getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)` which applies HTML en...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects Apache Tomcat 8.5.0 to 8.5.39. The target version is 8.5.100, which is 61 minor versions beyond the affected range. The vulnerability (unescaped output in SSI printenv command) has been fixed in the target code. The file java/org/apache/catalina/ssi/SSIPrintenv.java line 44 uses `ssiMediator.getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)` which applies HTML en..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 8.5.100-tuxcare.10. The vulnerability was a regression where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix (commit 959f1dfd767 by Mark Thomas, 2019-12-17) validates Transfer-Encoding headers and rejects invalid ones with a 400 Bad Request response. This fix was already present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 8.5.100-tuxcare.10. The vulnerability was a regression where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix (commit 959f1dfd767 by Mark Thomas, 2019-12-17) validates Transfer-Encoding headers and rejects invalid ones with a 400 Bad Request response. This fix was already present i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2020-13935 affects Apache Tomcat 8.5.0 to 8.5.56. The target version 8.5.100-tuxcare.10 already includes the upstream fix (commit 12d715676038ef, authored by Mark Thomas on 2020-06-29) that validates WebSocket frame payload length MSB. The fix was shipped in upstream Tomcat 8.5.57+ and was already present when TuxCare onboarded version 8.5.100. The vulnerable code pattern (missing MSB validation that could trigger infinite loop) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "impact_statement": "CVE-2020-13935 affects Apache Tomcat 8.5.0 to 8.5.56. The target version 8.5.100-tuxcare.10 already includes the upstream fix (commit 12d715676038ef, authored by Mark Thomas on 2020-06-29) that validates WebSocket frame payload length MSB. The fix was shipped in upstream Tomcat 8.5.57+ and was already present when TuxCare onboarded version 8.5.100. The vulnerable code pattern (missing MSB validation that could trigger infinite loop) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target Tomcat 8.5.100 already contains the CVE-2020-1935 fix from upstream Apache commit 8fbe2e962f by Mark Thomas. The fix was present in the upstream release before TuxCare adopted this version. The defense code at Http11InputBuffer.java:978-983 enforces strict CRLF validation (rejects CR not followed by LF) and blocks control characters in header values (except TAB), preventing the HTTP requ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 8.5.100 already contains the CVE-2020-1935 fix from upstream Apache commit 8fbe2e962f by Mark Thomas. The fix was present in the upstream release before TuxCare adopted this version. The defense code at Http11InputBuffer.java:978-983 enforces strict CRLF validation (rejects CR not followed by LF) and blocks control characters in header values (except TAB), preventing the HTTP requ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 8.5.100.tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2021-30639 is not present in Tomcat 8.5.100. The vulnerability involved a missing reset of the errorException field in the Request.recycle() method, causing persistent error states across request reuses and denial of service. The fix (adding errorException = null in recycle()) was applied by upstream Apache on 2021-03-24 in commit 411caf29ac, well before TuxCare adopted this codebase in 2025-05-07. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "impact_statement": "CVE-2021-30639 is not present in Tomcat 8.5.100. The vulnerability involved a missing reset of the errorException field in the Request.recycle() method, causing persistent error states across request reuses and denial of service. The fix (adding errorException = null in recycle()) was applied by upstream Apache on 2021-03-24 in commit 411caf29ac, well before TuxCare adopted this codebase in 2025-05-07. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:39:00.146582+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 8.5.0 to 8.5.65. The vulnerability allows authentication bypass through special characters in usernames (e.g., ';', '*') that are not properly escaped in JNDI/LDAP operations. The target version 8.5.100 is NOT vulnerable - the fix was already included in upstream release 8.5.66 (first tagged release containing the fix). The target contains complete escaping ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 8.5.0 to 8.5.65. The vulnerability allows authentication bypass through special characters in usernames (e.g., ';', '*') that are not properly escaped in JNDI/LDAP operations. The target version 8.5.100 is NOT vulnerable - the fix was already included in upstream release 8.5.66 (first tagged release containing the fix). The target contains complete escaping ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T04:33:00.174613+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 8.5.100. All three vulnerability patterns described in the CVE have been fixed by upstream Apache Tomcat commits that were already included in the 8.5.100 release before TuxCare adoption. The CVE affected versions 8.5.0 to 8.5.66; version 8.5.100 includes upstream fixes from Mark Thomas (markt@apache.org) that: (1) process Transfer-Encoding headers from H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 8.5.100. All three vulnerability patterns described in the CVE have been fixed by upstream Apache Tomcat commits that were already included in the 8.5.100 release before TuxCare adoption. The CVE affected versions 8.5.0 to 8.5.66; version 8.5.100 includes upstream fixes from Mark Thomas (markt@apache.org) that: (1) process Transfer-Encoding headers from H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.100 is not affected by CVE-2021-41079. The vulnerability involves infinite loops in OpenSSLEngine.unwrap() that could be triggered by specially crafted TLS packets. Both upstream fixes (buffer state validation and bytesRead validation) were already present in version 8.5.100 when TuxCare onboarded it. The CVE affected versions 8.5.0-8.5.63, but 8.5.100 > 8.5.63 and contains the complete fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "impact_statement": "Apache Tomcat 8.5.100 is not affected by CVE-2021-41079. The vulnerability involves infinite loops in OpenSSLEngine.unwrap() that could be triggered by specially crafted TLS packets. Both upstream fixes (buffer state validation and bytesRead validation) were already present in version 8.5.100 when TuxCare onboarded it. The CVE affected versions 8.5.0-8.5.63, but 8.5.100 > 8.5.63 and contains the complete fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Version 8.5.100 is not vulnerable. Summary: Apache Tomcat 8.5.100-tuxcare.6 is NOT vulnerable to CVE-2021-42340. The target version is beyond the vulnerable range (8.5.60 to 8.5.71) and contains the necessary fix. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "Version 8.5.100 is not vulnerable. Summary: Apache Tomcat 8.5.100-tuxcare.6 is NOT vulnerable to CVE-2021-42340. The target version is beyond the vulnerable range (8.5.60 to 8.5.71) and contains the necessary fix. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T01:36:00.090546+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 is NOT present in target Tomcat 8.5.100. The vulnerability involved a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The upstream fix (commit 4a00b0c0890538b9d3107eef8f2e0afadd119beb by Mark Thomas) changed currentProcessor from a simple field to AtomicReference and introduced takeCurrentProcesso...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 is NOT present in target Tomcat 8.5.100. The vulnerability involved a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The upstream fix (commit 4a00b0c0890538b9d3107eef8f2e0afadd119beb by Mark Thomas) changed currentProcessor from a simple field to AtomicReference and introduced takeCurrentProcesso..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:40.381958+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2022-23181 TOCTOU vulnerability was already fixed in upstream Apache Tomcat 8.5.100 release. The fix (commit 97943959ba by Mark Thomas, dated Jan 12, 2022) ensures the same canonical file object validated in the security check is returned and used, eliminating the time-of-check-time-of-use gap. This fix was present in the Tomcat 8.5.100 tag (March 19, 2024) before TuxCare onboarded the version (commit e0a4054d). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "impact_statement": "CVE-2022-23181 TOCTOU vulnerability was already fixed in upstream Apache Tomcat 8.5.100 release. The fix (commit 97943959ba by Mark Thomas, dated Jan 12, 2022) ensures the same canonical file object validated in the security check is returned and used, eliminating the time-of-check-time-of-use gap. This fix was present in the Tomcat 8.5.100 tag (March 19, 2024) before TuxCare onboarded the version (commit e0a4054d). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2022-25762. The vulnerability (WebSocket message sent concurrently with connection closing causing socket double-pooling and data misdelivery) was fixed by upstream Apache in version 8.5.76 (commit 01f2cf25b2 by Mark Thomas, 2022-02-18). The target version 8.5.100 already contains the complete fix: CLOSED_NIO_CHANNEL sentinel objects, closed-socket checks before read/write operations, and proper async IO error handling in WebSocket message transmission. The fix was present in the upstream release before TuxCare onboarded this version, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "impact_statement": "Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2022-25762. The vulnerability (WebSocket message sent concurrently with connection closing causing socket double-pooling and data misdelivery) was fixed by upstream Apache in version 8.5.76 (commit 01f2cf25b2 by Mark Thomas, 2022-02-18). The target version 8.5.100 already contains the complete fix: CLOSED_NIO_CHANNEL sentinel objects, closed-socket checks before read/write operations, and proper async IO error handling in WebSocket message transmission. The fix was present in the upstream release before TuxCare onboarded this version, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation vulnerability where Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks. The target repository (Tomcat 8.5.100) already contains the corrected documentation that explicitly warns users EncryptInterceptor does not protect against DoS attacks on untrusted networks. The fix was included in upstream release 8.5.79 by Mark Thomas (markt@apache.org) before TuxCare began maintaining this version. All three affected documentation files (cluster-howto.xml, config/cluster.xml, security-howto.xml) contain the corrected warnings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "impact_statement": "CVE-2022-29885 is a documentation vulnerability where Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks. The target repository (Tomcat 8.5.100) already contains the corrected documentation that explicitly warns users EncryptInterceptor does not protect against DoS attacks on untrusted networks. The fix was included in upstream release 8.5.79 by Mark Thomas (markt@apache.org) before TuxCare began maintaining this version. All three affected documentation files (cluster-howto.xml, config/cluster.xml, security-howto.xml) contain the corrected warnings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 is not present in Apache Tomcat 8.5.100. The fix for this XSS vulnerability was authored by upstream Apache developer Mark Thomas (markt@apache.org) on June 23, 2022, and was included in the upstream Apache Tomcat 8.5.100 release. TuxCare's 8.5.100 branch inherited this fix from the upstream release. The vulnerable file (webapps/examples/jsp/security/protected/index.jsp) properly...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 is not present in Apache Tomcat 8.5.100. The fix for this XSS vulnerability was authored by upstream Apache developer Mark Thomas (markt@apache.org) on June 23, 2022, and was included in the upstream Apache Tomcat 8.5.100 release. TuxCare's 8.5.100 branch inherited this fix from the upstream release. The vulnerable file (webapps/examples/jsp/security/protected/index.jsp) properly..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T00:47:50.558433+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T19:05:19.418788+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Version 8.5.100 is not affected by CVE-2024-54677: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "impact_statement": "Version 8.5.100 is not affected by CVE-2024-54677: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533\". No backport needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      },
      "action_statement": "Vulnerability CVE-2025-61795 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.100 is NOT affected by CVE-2026-29129. The vulnerability was introduced in newer versions (9.0.114-115, 10.1.51-52, 11.0.16-18) when TLS 1.3 specific cipher configuration was added. The vulnerable code pattern (using HashSet to combine TLS 1.3 and legacy cipher lists, losing configured preference order) does not exist in version 8.5.100, which lacks separate TLS 1.3 cipher con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is NOT affected by CVE-2026-29129. The vulnerability was introduced in newer versions (9.0.114-115, 10.1.51-52, 11.0.16-18) when TLS 1.3 specific cipher configuration was added. The vulnerable code pattern (using HashSet to combine TLS 1.3 and legacy cipher lists, losing configured preference order) does not exist in version 8.5.100, which lacks separate TLS 1.3 cipher con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:37.174917+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-95jq-rwvf-vjx4 (newer lines only), NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-95jq-rwvf-vjx4 (newer lines only), NVD (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:23:27.725950+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 does not affect version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.100 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:25.894192+00:00",
      "status_notes": "Vulnerability CVE-2026-50229 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-50229"
      },
      "action_statement": "Vulnerability CVE-2026-50229 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:25.894192+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:42:00.050702+00:00",
      "status_notes": "Vulnerability CVE-2026-55955 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55955"
      },
      "action_statement": "Vulnerability CVE-2026-55955 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.100.tuxcare.1 of org.apache.tomcat:tomcat."
    }
  ]
}