{
  "@id": "urn:uuid:0cf65f0d-9089-41c1-902e-82c40b112870",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 62,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:42:00.103673+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 9.0.100. The XSS vulnerability in the host-manager HTML interface was fixed by upstream Apache in 2008 (commit 49c71fc59c by Mark Thomas). This fix has been present in all Tomcat 9.0.x releases since 9.0.0-M1, including the 9.0.100 release that TuxCare onboarded. The current code properly escapes all user-controlled input (hostname, aliases, message...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 9.0.100. The XSS vulnerability in the host-manager HTML interface was fixed by upstream Apache in 2008 (commit 49c71fc59c by Mark Thomas). This fix has been present in all Tomcat 9.0.x releases since 9.0.0-M1, including the 9.0.100 release that TuxCare onboarded. The current code properly escapes all user-controlled input (hostname, aliases, message..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:30:04.751558+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE in XML configuration parsing) is not present in Tomcat 9.0.100. The upstream Apache fix that blocks external entity resolution was already included in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The defense is implemented via LocalResolver with blockExternal=true by default, preventing XML parsers from resolving external entities not in the well-known whitelist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4590 (XXE in XML configuration parsing) is not present in Tomcat 9.0.100. The upstream Apache fix that blocks external entity resolution was already included in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The defense is implemented via LocalResolver with blockExternal=true by default, preventing XML parsers from resolving external entities not in the well-known whitelist."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:26:05.403942+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target is not affected by CVE-2015-5174. While RequestUtil.normalize() lacks the upstream patch's fix (moving /./../.. validation to after normalization), an upstream-authored alternative defense exists at StandardRoot.validate() (line 258-259) that blocks directory traversal by rejecting any normalized path that doesn't start with '/'. This defense was added in March 2014 (commit 979b3c0a86 by...",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "impact_statement": "not_affected \u2014 Target is not affected by CVE-2015-5174. While RequestUtil.normalize() lacks the upstream patch's fix (moving /./../.. validation to after normalization), an upstream-authored alternative defense exists at StandardRoot.validate() (line 258-259) that blocks directory traversal by rejecting any normalized path that doesn't start with '/'. This defense was added in March 2014 (commit 979b3c0a86 by..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:42:00.103673+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). The upstream fix was released in 9.0.0.M2, and version 9.0.100 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). The upstream fix was released in 9.0.0.M2, and version 9.0.100 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:24:40.013420+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 affects Apache Tomcat versions before 9.0.0.M2 due to StatusManagerServlet not being in the RestrictedServlets.properties list. The target (Tomcat 9.0.100) is NOT AFFECTED because the fix was already included in the upstream 9.0.100 release. The RestrictedServlets.properties file correctly contains \"org.apache.catalina.manager.StatusManagerServlet=restricted\" at line 19, preventin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0706 affects Apache Tomcat versions before 9.0.0.M2 due to StatusManagerServlet not being in the RestrictedServlets.properties list. The target (Tomcat 9.0.100) is NOT AFFECTED because the fix was already included in the upstream 9.0.100 release. The RestrictedServlets.properties file correctly contains \"org.apache.catalina.manager.StatusManagerServlet=restricted\" at line 19, preventin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T10:46:21.880249+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 9.0.100 is NOT AFFECTED by CVE-2016-0762. The timing attack vulnerability in Realm authentication implementations was fixed by upstream commit 86b2e436099cb48f30dad950175c5beeeb763756 (authored by Mark Thomas, markt@apache.org), which was already present in the upstream release 9.0.100 that TuxCare onboarded. All affected Realm implementations (RealmBase, DataSourceRealm, J...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 9.0.100 is NOT AFFECTED by CVE-2016-0762. The timing attack vulnerability in Realm authentication implementations was fixed by upstream commit 86b2e436099cb48f30dad950175c5beeeb763756 (authored by Mark Thomas, markt@apache.org), which was already present in the upstream release 9.0.100 that TuxCare onboarded. All affected Realm implementations (RealmBase, DataSourceRealm, J..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:35:11.447756+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 affects the `setGlobalContext` method in `ResourceLinkFactory.java`, which originally lacked authorization checks allowing remote authenticated users to bypass SecurityManager restrictions and read/write arbitrary application data. The upstream fix (commit 76ebc9007567c8326217dd94844540e1e27d8468 by kkolinko@apache.org) adds a SecurityManager permission check requiring RuntimePerm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0763 affects the `setGlobalContext` method in `ResourceLinkFactory.java`, which originally lacked authorization checks allowing remote authenticated users to bypass SecurityManager restrictions and read/write arbitrary application data. The upstream fix (commit 76ebc9007567c8326217dd94844540e1e27d8468 by kkolinko@apache.org) adds a SecurityManager permission check requiring RuntimePerm..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T10:28:19.187215+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is NOT present in Tomcat 9.0.100. The vulnerability allowed malicious web applications to bypass SecurityManager and read protected system properties through configuration file property replacement. The fix was implemented by Apache upstream (Mark Thomas, commit c1660182010b4255c21c874d69c124370a67784a) in July 2016, introducing the PermissionCheck interface that validates permiss...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6794 is NOT present in Tomcat 9.0.100. The vulnerability allowed malicious web applications to bypass SecurityManager and read protected system properties through configuration file property replacement. The fix was implemented by Apache upstream (Mark Thomas, commit c1660182010b4255c21c874d69c124370a67784a) in July 2016, introducing the PermissionCheck interface that validates permiss..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6796 is NOT present in Apache Tomcat 9.0.100. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The upstream Apache Tomcat project fixed this vulnerability in version 9.0.24 (commit f603f2f459 by Mark Thomas, August 2016). Since the target version 9.0.100 is significantly newer than 9.0.24, it inherits this fix from the upstream release. Both security checks are present and functional in the target code: JspServlet.java lines 89-93 ignore engineOptionsClass when Constants.IS_SECURITY_ENABLED is true, and EmbeddedServletOptions.java lines 594-597 ignore scratchdir under the same condition. This is an upstream vendor fix that was already present before TuxCare onboarded the 9.0.100 codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "impact_statement": "CVE-2016-6796 is NOT present in Apache Tomcat 9.0.100. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The upstream Apache Tomcat project fixed this vulnerability in version 9.0.24 (commit f603f2f459 by Mark Thomas, August 2016). Since the target version 9.0.100 is significantly newer than 9.0.24, it inherits this fix from the upstream release. Both security checks are present and functional in the target code: JspServlet.java lines 89-93 ignore engineOptionsClass when Constants.IS_SECURITY_ENABLED is true, and EmbeddedServletOptions.java lines 594-597 ignore scratchdir under the same condition. This is an upstream vendor fix that was already present before TuxCare onboarded the 9.0.100 codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6797 is not present in Tomcat 9.0.100. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was introduced by Apache Tomcat upstream in commit 2859ac3eae (authored by Mark Thomas on Aug 22, 2016) and shipped in the upstream release before TuxCare onboarded version 9.0.100. The fix adds a registration-based access control system that validates each web application's ClassLoader has been explicitly registered to access specific global resources before allowing lookup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "impact_statement": "CVE-2016-6797 is not present in Tomcat 9.0.100. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was introduced by Apache Tomcat upstream in commit 2859ac3eae (authored by Mark Thomas on Aug 22, 2016) and shipped in the upstream release before TuxCare onboarded version 9.0.100. The fix adds a registration-based access control system that validates each web application's ClassLoader has been explicitly registered to access specific global resources before allowing lookup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6817 is NOT present in the target. The vulnerability involved an infinite loop in HTTP/2 header parsing when headers exceeded buffer capacity. The fix (commit 079372fc7b by Mark Thomas) was already included in upstream Tomcat 9.0.100 before TuxCare onboarded it. The target code contains complete buffer expansion logic (lines 512-524 of Http2Parser.java) that prevents the infinite loop by dynamically expanding headerReadBuffer when capacity is exhausted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "impact_statement": "CVE-2016-6817 is NOT present in the target. The vulnerability involved an infinite loop in HTTP/2 header parsing when headers exceeded buffer capacity. The fix (commit 079372fc7b by Mark Thomas) was already included in upstream Tomcat 9.0.100 before TuxCare onboarded it. The target code contains complete buffer expansion logic (lines 512-524 of Http2Parser.java) that prevents the infinite loop by dynamically expanding headerReadBuffer when capacity is exhausted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 due to improper ByteBuffer state management in Http11InputBuffer.nextRequest() that could cause data from one HTTP request to leak into another request. The target repository (Tomcat 9.0.100) is NOT AFFECTED because the vulnerability was fixed by upstream Apache commits in December 2016, well before the 9.0.100 release. The fix was authored by Mark Thomas (Apache upstream developer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "impact_statement": "CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 due to improper ByteBuffer state management in Http11InputBuffer.nextRequest() that could cause data from one HTTP request to leak into another request. The target repository (Tomcat 9.0.100) is NOT AFFECTED because the vulnerability was fixed by upstream Apache commits in December 2016, well before the 9.0.100 release. The fix was authored by Mark Thomas (Apache upstream developer) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5647 is NOT present in Tomcat 9.0.100-tuxcare.6. The vulnerability involved pipelined HTTP requests being lost when sendfile processing completed on keep-alive connections, causing response/request mismatch. The upstream fix by Mark Thomas (commit 864aa1199a) was included in the Tomcat 9.0.100 release before TuxCare started maintaining this version. The fix is comprehensively present: the new SendfileKeepAliveState enum exists, Http11Processor checks for pipelined data before completing sendfile, and endpoints properly handle the PIPELINED state by immediately processing buffered requests instead of dropping them.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "impact_statement": "CVE-2017-5647 is NOT present in Tomcat 9.0.100-tuxcare.6. The vulnerability involved pipelined HTTP requests being lost when sendfile processing completed on keep-alive connections, causing response/request mismatch. The upstream fix by Mark Thomas (commit 864aa1199a) was included in the Tomcat 9.0.100 release before TuxCare started maintaining this version. The fix is comprehensively present: the new SendfileKeepAliveState enum exists, Http11Processor checks for pipelined data before completing sendfile, and endpoints properly handle the PIPELINED state by immediately processing buffered requests instead of dropping them.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5650 is not present in Apache Tomcat 9.0.100. The vulnerability, which allowed malicious HTTP/2 clients to exhaust server processing capacity by sending GOAWAY frames without properly closing associated streams, was fixed by Apache upstream in March 2017 (commits 5496e193a8 and c909f01471 by Mark Thomas). The fix was included in version 9.0.0-M19 and all subsequent versions. The target version 9.0.100 is much newer and contains the complete fix in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "impact_statement": "CVE-2017-5650 is not present in Apache Tomcat 9.0.100. The vulnerability, which allowed malicious HTTP/2 clients to exhaust server processing capacity by sending GOAWAY frames without properly closing associated streams, was fixed by Apache upstream in March 2017 (commits 5496e193a8 and c909f01471 by Mark Thomas). The fix was included in version 9.0.0-M19 and all subsequent versions. The target version 9.0.100 is much newer and contains the complete fix in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5664 is NOT present in Tomcat 9.0.100. The vulnerability concerned DefaultServlet and WebdavServlet processing error dispatches with non-GET HTTP methods (PUT, DELETE), potentially allowing file modification/deletion of static error pages. The fix was introduced by upstream Apache developer Mark Thomas in commit 7d93527254, which shipped in Tomcat 9.0.0-M21 (May 2017). This predates the 9.0.100 release that TuxCare onboarded. Both DefaultServlet.java and WebdavServlet.java contain the protective service() method override that intercepts DispatcherType.ERROR requests and forces processing through doGet(), preventing write/delete operations. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "impact_statement": "CVE-2017-5664 is NOT present in Tomcat 9.0.100. The vulnerability concerned DefaultServlet and WebdavServlet processing error dispatches with non-GET HTTP methods (PUT, DELETE), potentially allowing file modification/deletion of static error pages. The fix was introduced by upstream Apache developer Mark Thomas in commit 7d93527254, which shipped in Tomcat 9.0.0-M21 (May 2017). This predates the 9.0.100 release that TuxCare onboarded. Both DefaultServlet.java and WebdavServlet.java contain the protective service() method override that intercepts DispatcherType.ERROR requests and forces processing through doGet(), preventing write/delete operations. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T10:38:23.915288+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is NOT present in Tomcat 9.0.100. The vulnerability (CORS Filter not adding Vary: Origin header, allowing cache poisoning) was already fixed in the upstream Apache Tomcat release before TuxCare onboarded version 9.0.100. The defense code exists at CorsFilter.java:374 where ResponseUtil.addVaryFieldName(response, REQUEST_HEADER_ORIGIN) adds the required Vary header to prevent cache...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-7674 is NOT present in Tomcat 9.0.100. The vulnerability (CORS Filter not adding Vary: Origin header, allowing cache poisoning) was already fixed in the upstream Apache Tomcat release before TuxCare onboarded version 9.0.100. The defense code exists at CorsFilter.java:374 where ResponseUtil.addVaryFieldName(response, REQUEST_HEADER_ORIGIN) adds the required Vary header to prevent cache..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation where path parameters in URLs were not properly processed, allowing security constraint bypass. The vulnerability existed in versions 9.0.0.M1-9.0.0.M21 and 8.5.0-8.5.15. The target version 9.0.100 already contains the upstream fix (Bug 61120) that was applied in May 2017. The fix changes HTTP/2 URI processing from setString() to setBytes(), ensuring path parameters undergo proper validation and normalization security checks. This fix was already present in the upstream Apache Tomcat 9.0.100 release when TuxCare onboarded it via commit 962333f6197a91455d96b9de150442edd9a01744.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "impact_statement": "CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation where path parameters in URLs were not properly processed, allowing security constraint bypass. The vulnerability existed in versions 9.0.0.M1-9.0.0.M21 and 8.5.0-8.5.15. The target version 9.0.100 already contains the upstream fix (Bug 61120) that was applied in May 2017. The fix changes HTTP/2 URI processing from setString() to setBytes(), ensuring path parameters undergo proper validation and normalization security checks. This fix was already present in the upstream Apache Tomcat 9.0.100 release when TuxCare onboarded it via commit 962333f6197a91455d96b9de150442edd9a01744.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Apache Tomcat 9.0.100-tuxcare.6 already contains the upstream fix (commit 15fcd166ea) that adds HTML entity encoding to variable output via the ENCODING_ENTITY parameter. This fix was authored by Mark Thomas (markt@apache.org) and was already present in the upstream Apache...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Apache Tomcat 9.0.100-tuxcare.6 already contains the upstream fix (commit 15fcd166ea) that adds HTML entity encoding to variable output via the ENCODING_ENTITY parameter. This fix was authored by Mark Thomas (markt@apache.org) and was already present in the upstream Apache..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:27:00.867186+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28 to 9.0.30. Target version 9.0.100 is not affected because the fix for invalid Transfer-Encoding header validation was already present in the upstream Apache Tomcat 9.0.100 release. The vulnerable code pattern (accepting invalid Transfer-Encoding headers without validation) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28 to 9.0.30. Target version 9.0.100 is not affected because the fix for invalid Transfer-Encoding header validation was already present in the upstream Apache Tomcat 9.0.100 release. The vulnerable code pattern (accepting invalid Transfer-Encoding headers without validation) is not present in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13934 is not present in Tomcat 9.0.100. The vulnerability (h2c direct connection causing HTTP/1.1 processor leak leading to pool exhaustion) was fixed in upstream Apache Tomcat 9.0.37 (June 30, 2020) via commit 172977f04a authored by Mark Thomas (markt@apache.org). The fix adds release(processor) before creating the h2c upgrade processor and changes control flow to ensure proper cleanup. Since version 9.0.100 (released Feb 13, 2025) is later than 9.0.37, it inherently includes this upstream fix. The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 is not present in Tomcat 9.0.100. The vulnerability (h2c direct connection causing HTTP/1.1 processor leak leading to pool exhaustion) was fixed in upstream Apache Tomcat 9.0.37 (June 30, 2020) via commit 172977f04a authored by Mark Thomas (markt@apache.org). The fix adds release(processor) before creating the h2c upgrade processor and changes control flow to ensure proper cleanup. Since version 9.0.100 (released Feb 13, 2025) is later than 9.0.37, it inherently includes this upstream fix. The vulnerable code pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.100 is NOT affected by CVE-2020-13935. The vulnerability (invalid WebSocket payload length with MSB set causing infinite loop/DoS) was fixed by upstream Apache in commit 40fa74c748 (Mark Thomas, 2020-06-29). This fix was already present in the upstream Apache Tomcat 9.0.100 release before TuxCare onboarding (first TuxCare commit: 962333f619 \"Setup 9.0.100\"). The fix adds validation in WsFrameBase.java that rejects WebSocket frames with negative payload length values (RFC 6455 section 5.2 violation), preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "impact_statement": "Apache Tomcat 9.0.100 is NOT affected by CVE-2020-13935. The vulnerability (invalid WebSocket payload length with MSB set causing infinite loop/DoS) was fixed by upstream Apache in commit 40fa74c748 (Mark Thomas, 2020-06-29). This fix was already present in the upstream Apache Tomcat 9.0.100 release before TuxCare onboarding (first TuxCare commit: 962333f619 \"Setup 9.0.100\"). The fix adds validation in WsFrameBase.java that rejects WebSocket frames with negative payload length values (RFC 6455 section 5.2 violation), preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935: Apache Tomcat 9.0.100 is NOT AFFECTED. The vulnerability (improper HTTP header CRLF parsing allowing invalid headers to be accepted) was fixed by Apache upstream in commit 8bfb0ff7 authored by markt@apache.org on 2020-01-06. This fix shipped in the Apache Tomcat 9.0.100 release before TuxCare onboarded the version. All defense components are present in the target code: prevChr tr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935: Apache Tomcat 9.0.100 is NOT AFFECTED. The vulnerability (improper HTTP header CRLF parsing allowing invalid headers to be accepted) was fixed by Apache upstream in commit 8bfb0ff7 authored by markt@apache.org on 2020-01-06. This fix shipped in the Apache Tomcat 9.0.100 release before TuxCare onboarded the version. All defense components are present in the target code: prevChr tr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.100-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-30639 affects Apache Tomcat versions 10.0.3-10.0.4, 9.0.44, and 8.5.64 due to failure to reset the errorException field in Request.recycle(), causing permanent request object failure after a non-blocking I/O error. The target version 9.0.100 is NOT affected because the upstream fix (commit 8ece47c4a9 by Mark Thomas, 2021-03-24) was already included in the Apache Tomcat 9.0.100 release before TuxCare onboarded it. The fix correctly resets errorException to null at line 765 of Request.java, preventing error state persistence across request reuses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "impact_statement": "CVE-2021-30639 affects Apache Tomcat versions 10.0.3-10.0.4, 9.0.44, and 8.5.64 due to failure to reset the errorException field in Request.recycle(), causing permanent request object failure after a non-blocking I/O error. The target version 9.0.100 is NOT affected because the upstream fix (commit 8ece47c4a9 by Mark Thomas, 2021-03-24) was already included in the Apache Tomcat 9.0.100 release before TuxCare onboarded it. The fix correctly resets errorException to null at line 765 of Request.java, preventing error state persistence across request reuses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:41:00.083121+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 is NOT present in Apache Tomcat 9.0.100-tuxcare.6. The vulnerability involves insufficient escaping of LDAP special characters in usernames within JNDIRealm, allowing authentication with username variations. The complete fix was authored by Mark Thomas (markt@apache.org) in April 2021 and shipped in the upstream Apache Tomcat 9.0.100 release. TuxCare onboarded this release in Dec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-30640 is NOT present in Apache Tomcat 9.0.100-tuxcare.6. The vulnerability involves insufficient escaping of LDAP special characters in usernames within JNDIRealm, allowing authentication with username variations. The complete fix was authored by Mark Thomas (markt@apache.org) in April 2021 and shipped in the upstream Apache Tomcat 9.0.100 release. TuxCare onboarded this release in Dec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T04:36:00.070178+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 9.0.100. All three required defenses are present in the target code: (1) \"identity\" transfer encoding is rejected with 501, (2) chunked encoding is enforced as the final encoding with 400 error if violated, and (3) Transfer-Encoding headers are processed from both HTTP 1.0 and 1.1 clients. These fixes were applied upstream by Apache in May 2021 (co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 9.0.100. All three required defenses are present in the target code: (1) \"identity\" transfer encoding is rejected with 501, (2) chunked encoding is enforced as the final encoding with 400 error if violated, and (3) Transfer-Encoding headers are processed from both HTTP 1.0 and 1.1 clients. These fixes were applied upstream by Apache in May 2021 (co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.100 is NOT vulnerable to CVE-2021-41079. The vulnerability, which could trigger an infinite loop DoS when processing specially crafted TLS packets with NIO+OpenSSL or NIO2+OpenSSL, was fixed by upstream Apache Tomcat in commit d4b340fa8fe (March 3, 2021, by Mark Thomas). This fix was already present in the upstream 9.0.44 release (March 10, 2021) and is included in version 9.0.100. The fix prevents the infinite loop by: (1) moving error checking into readPlaintextData() which converts any negative/zero OpenSSL read results into either an SSLException (if OpenSSL reports an error) or returns 0, and (2) throwing IllegalStateException in the unwrap() loop when bytesRead is 0 while pendingApp > 0, breaking the loop instead of continuing. Both OpenSSLEngine implementations (original and Panama FFM) contain the defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "impact_statement": "The target Apache Tomcat 9.0.100 is NOT vulnerable to CVE-2021-41079. The vulnerability, which could trigger an infinite loop DoS when processing specially crafted TLS packets with NIO+OpenSSL or NIO2+OpenSSL, was fixed by upstream Apache Tomcat in commit d4b340fa8fe (March 3, 2021, by Mark Thomas). This fix was already present in the upstream 9.0.44 release (March 10, 2021) and is included in version 9.0.100. The fix prevents the infinite loop by: (1) moving error checking into readPlaintextData() which converts any negative/zero OpenSSL read results into either an SSLException (if OpenSSL reports an error) or returns 0, and (2) throwing IllegalStateException in the unwrap() loop when bytesRead is 0 while pendingApp > 0, breaking the loop instead of continuing. Both OpenSSLEngine implementations (original and Panama FFM) contain the defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2021-42340 is NOT present in this repository. The fix for the WebSocket connection memory leak has already been applied. The target repository (Apache Tomcat 9.0.100) contains the complete upstream fix from commit 80f1438ec45 (2021-09-27) which properly manages WebConnection references to prevent memory leaks when WebSocket connections are closed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "already_fixed \u2014 CVE-2021-42340 is NOT present in this repository. The fix for the WebSocket connection memory leak has already been applied. The target repository (Apache Tomcat 9.0.100) contains the complete upstream fix from commit 80f1438ec45 (2021-09-27) which properly manages WebConnection references to prevent memory leaks when WebSocket connections are closed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T01:38:00.183284+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60 due to a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The target version 9.0.100 already contains the upstream fix (commit 170e0f792b by Mark Thomas, March 2022) which was shipped in the Apache Tomcat 9.0.61+ release. The fix uses AtomicReference for thread-saf...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60 due to a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The target version 9.0.100 already contains the upstream fix (commit 170e0f792b by Mark Thomas, March 2022) which was shipped in the Apache Tomcat 9.0.61+ release. The fix uses AtomicReference for thread-saf..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:40.381958+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-23181 affects Tomcat versions 9.0.35 to 9.0.56. The target version 9.0.100 already contains the upstream fix (commit 1385c624b4) authored by Mark Thomas that eliminates the TOCTOU vulnerability in FileStore. The fix ensures the canonical file path is computed once and used consistently for both validation and file operations, preventing the race condition. This fix was included in the upstream Tomcat 9.0.100 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (962333f619 \"Setup 9.0.100\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "impact_statement": "CVE-2022-23181 affects Tomcat versions 9.0.35 to 9.0.56. The target version 9.0.100 already contains the upstream fix (commit 1385c624b4) authored by Mark Thomas that eliminates the TOCTOU vulnerability in FileStore. The fix ensures the canonical file path is computed once and used consistently for both validation and file operations, preventing the race condition. This fix was included in the upstream Tomcat 9.0.100 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (962333f619 \"Setup 9.0.100\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.100 is not affected by CVE-2022-25762. The vulnerability (WebSocket message sent concurrently with connection close causing socket reuse and pool corruption) was fixed by upstream Apache before version 9.0.100 was released. The fix introduces an immutable CLOSED_NIO_CHANNEL sentinel that replaces the actual socket/channel when closing, with checks before all I/O operations to throw ClosedChannelException instead of proceeding with closed sockets. This prevents the socket from being used after close and prevents double-pooling. The fix was already present in the upstream 9.0.100 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "impact_statement": "The target Apache Tomcat 9.0.100 is not affected by CVE-2022-25762. The vulnerability (WebSocket message sent concurrently with connection close causing socket reuse and pool corruption) was fixed by upstream Apache before version 9.0.100 was released. The fix introduces an immutable CLOSED_NIO_CHANNEL sentinel that replaces the actual socket/channel when closing, with checks before all I/O operations to throw ClosedChannelException instead of proceeding with closed sockets. This prevents the socket from being used after close and prevents double-pooling. The fix was already present in the upstream 9.0.100 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only vulnerability. The Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks, when it only provides confidentiality/integrity protection but not DoS protection. All patches modify only XML documentation files (cluster-howto.xml, cluster.xml, security-howto.xml) to clarify this limitation. The target repository (Tomcat 9.0.100) already contains the corrected documentation from the upstream release. The fix was authored by Mark Thomas (markt@apache.org) and was included in upstream release 9.0.100 before TuxCare onboarded it. The vulnerable documentation pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "impact_statement": "CVE-2022-29885 is a documentation-only vulnerability. The Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks, when it only provides confidentiality/integrity protection but not DoS protection. All patches modify only XML documentation files (cluster-howto.xml, cluster.xml, security-howto.xml) to clarify this limitation. The target repository (Tomcat 9.0.100) already contains the corrected documentation from the upstream release. The fix was authored by Mark Thomas (markt@apache.org) and was included in upstream release 9.0.100 before TuxCare onboarded it. The vulnerable documentation pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Tomcat 9.0.100. The upstream Apache fix (commit 8b60af90b9) was already included in version 9.0.65, well before the 9.0.100 release. All user-controlled data in the Form authentication example (session attributes at lines 178-179, principal attributes at lines 112-114) are properly filtered with util.HTMLFilter.filter() which encodes HTML speci...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Tomcat 9.0.100. The upstream Apache fix (commit 8b60af90b9) was already included in version 9.0.65, well before the 9.0.100 release. All user-controlled data in the Form authentication example (session attributes at lines 178-179, principal attributes at lines 112-114) are properly filtered with util.HTMLFilter.filter() which encodes HTML speci..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T00:50:04.588656+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) does NOT affect Tomcat 9.0.100. The upstream fix by Mark Thomas (markt@apache.org, commit 77c0ce2d1..., August 22, 2023) was already present in Apache Tomcat 9.0.100 before TuxCare onboarded it. The fix strips extra leading slashes from redirect URLs in FormAuthenticator.savedRequestURL() (lines 766-769), preventing protocol-relative URL red...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) does NOT affect Tomcat 9.0.100. The upstream fix by Mark Thomas (markt@apache.org, commit 77c0ce2d1..., August 22, 2023) was already present in Apache Tomcat 9.0.100 before TuxCare onboarded it. The fix strips extra leading slashes from redirect URLs in FormAuthenticator.savedRequestURL() (lines 766-769), preventing protocol-relative URL red..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:23:53.811682+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T19:07:12.211534+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is not present in Tomcat 9.0.100. The vulnerability (improper parsing of HTTP trailer headers in chunked transfer encoding requests, enabling request smuggling) was fixed in upstream Apache Tomcat through architectural refactoring that introduced the HttpHeaderParser class with proper validation of trailer header names and values. This upstream fix was already present in the 9.0....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is not present in Tomcat 9.0.100. The vulnerability (improper parsing of HTTP trailer headers in chunked transfer encoding requests, enabling request smuggling) was fixed in upstream Apache Tomcat through architectural refactoring that introduced the HttpHeaderParser class with proper validation of trailer header names and values. This upstream fix was already present in the 9.0...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T19:12:23.322086+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2024-54677 affects Apache Tomcat 9.0.0.M1 through 9.0.97 via uncontrolled resource consumption in the examples web application. The target (version 9.0.100) is NOT AFFECTED because all upstream fixes for this CVE were already present in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The vulnerable pattern (unlimited session attribute storage, arbitrary shopping cart items, vulner...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-54677 affects Apache Tomcat 9.0.0.M1 through 9.0.97 via uncontrolled resource consumption in the examples web application. The target (version 9.0.100) is NOT AFFECTED because all upstream fixes for this CVE were already present in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The vulnerable pattern (unlimited session attribute storage, arbitrary shopping cart items, vulner..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:32:27.596761+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.100 is NOT AFFECTED by CVE-2026-29129. The vulnerability was introduced in upstream Tomcat on 2026-01-06 (commit 4ee45c5571) when TLS 1.3 cipher suite dual-list configuration support was added using HashSet, which loses insertion order. The bug was fixed on 2026-02-20 (commit 8d69b33764) by changing to LinkedHashSet. Version 9.0.100 predates this feature entirely - it never h...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.100 is NOT AFFECTED by CVE-2026-29129. The vulnerability was introduced in upstream Tomcat on 2026-01-06 (commit 4ee45c5571) when TLS 1.3 cipher suite dual-list configuration support was added using HashSet, which loses insertion order. The bug was fixed on 2026-02-20 (commit 8d69b33764) by changing to LinkedHashSet. Version 9.0.100 predates this feature entirely - it never h..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-25T20:17:00.165429+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat. Tomcat 9.0.100 is not affected by CVE-2026-29145. The flaw is that the FFM OpenSSL verify callback accepts non-SUCCESSFUL OCSP responses (e.g. TRY_LATER). On 9.0.100 the check in OpenSSLEngine still rejects them (UNKNOWN status with errnum <= 0 fails the handshake). The lenient check that caused the flaw (upstream 4881026c62, first in 9.0.111) is not present. The upstream fix d1406df5ae only re-codes these responses as X509_V_ERR_UNABLE_TO_GET_CRL for the ocspSoftFail switch added in 9.0.116, which 9.0.100 does not have. Applied to 9.0.100, that patch would turn the reject into an accept, as reproduced in docker with a TRY_LATER OCSP responder. The same backport was reverted on 10.1.42 (!331). No code change is needed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "impact_statement": "Tomcat 9.0.100 is not affected by CVE-2026-29145. The flaw is that the FFM OpenSSL verify callback accepts non-SUCCESSFUL OCSP responses (e.g. TRY_LATER). On 9.0.100 the check in OpenSSLEngine still rejects them (UNKNOWN status with errnum <= 0 fails the handshake). The lenient check that caused the flaw (upstream 4881026c62, first in 9.0.111) is not present. The upstream fix d1406df5ae only re-codes these responses as X509_V_ERR_UNABLE_TO_GET_CRL for the ocspSoftFail switch added in 9.0.116, which 9.0.100 does not have. Applied to 9.0.100, that patch would turn the reject into an accept, as reproduced in docker with a TRY_LATER OCSP responder. The same backport was reverted on 10.1.42 (!331). No code change is needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-50229 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-50229"
      },
      "action_statement": "Vulnerability CVE-2026-50229 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:42:00.050702+00:00",
      "status_notes": "Vulnerability CVE-2026-55955 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55955"
      },
      "action_statement": "Vulnerability CVE-2026-55955 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat."
    }
  ]
}