{
  "@id": "urn:uuid:42099159-d711-4962-88bb-331915f36c51",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 60,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:42:00.103673+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:53.139556+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the 'name' parameter was not escaped before being displayed. The target version (9.0.87) is NOT affected because the upstream vendor (Apache Tomcat) fixed this vulnerability in 2017 by introducing comprehensive HTML escaping via the Escape.htmlElementContent() utility. All user-controlled data, including ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in Apache Tomcat's host-manager HTML interface where the 'name' parameter was not escaped before being displayed. The target version (9.0.87) is NOT affected because the upstream vendor (Apache Tomcat) fixed this vulnerability in 2017 by introducing comprehensive HTML escaping via the Escape.htmlElementContent() utility. All user-controlled data, including ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:29:06.251625+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 is NOT present in Apache Tomcat 9.0.87. The XXE (XML External Entity) vulnerability was fixed in the upstream release through commit 05c84ff8304a69a30b251f207a7b93c2c882564d by Mark Thomas (markt@apache.org), which introduced the xmlBlockExternal configuration option and LocalResolver blocking logic. The fix is enabled by default (xmlBlockExternal=true) in StandardContext and bloc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4590 is NOT present in Apache Tomcat 9.0.87. The XXE (XML External Entity) vulnerability was fixed in the upstream release through commit 05c84ff8304a69a30b251f207a7b93c2c882564d by Mark Thomas (markt@apache.org), which introduced the xmlBlockExternal configuration option and LocalResolver blocking logic. The fix is enabled by default (xmlBlockExternal=true) in StandardContext and bloc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:21:43.801772+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.87 is NOT vulnerable to CVE-2015-5174. The directory traversal vulnerability via path normalization bypass is not present. The fix was already included in the upstream Apache Tomcat release that this version is based on. The vulnerable code pattern (checking for /.  and /.. BEFORE normalization, allowing bypass via patterns like //.. or /./../) does not exist. The current code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.87 is NOT vulnerable to CVE-2015-5174. The directory traversal vulnerability via path normalization bypass is not present. The fix was already included in the upstream Apache Tomcat release that this version is based on. The vulnerable code pattern (checking for /.  and /.. BEFORE normalization, allowing bypass via patterns like //.. or /./../) does not exist. The current code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:42:00.103673+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.87 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.87 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:23:31.441488+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is not present in Apache Tomcat 9.0.87. The vulnerability required StatusManagerServlet to be absent from the RestrictedServlets.properties list, allowing unprivileged applications to load it and access internal request tracking data including session IDs. The fix (adding the servlet to the restricted list) was applied by Apache upstream in January 2016 (commit c8601f802d) and shi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0706 is not present in Apache Tomcat 9.0.87. The vulnerability required StatusManagerServlet to be absent from the RestrictedServlets.properties list, allowing unprivileged applications to load it and access internal request tracking data including session IDs. The fix (adding the servlet to the restricted list) was applied by Apache upstream in January 2016 (commit c8601f802d) and shi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T10:46:21.880249+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 (timing attack vulnerability in Tomcat Realm implementations) is not present in target version 9.0.87. The upstream Apache fix (commit 86b2e436099cb48f30dad950175c5beeeb763756 by Mark Thomas, August 2016) added password processing via getCredentialHandler().mutate(credentials) when username is not found, eliminating the timing difference that allowed username enumeration. This fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0762 (timing attack vulnerability in Tomcat Realm implementations) is not present in target version 9.0.87. The upstream Apache fix (commit 86b2e436099cb48f30dad950175c5beeeb763756 by Mark Thomas, August 2016) added password processing via getCredentialHandler().mutate(credentials) when username is not found, eliminating the timing difference that allowed username enumeration. This fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T23:35:00.057151+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not affecting Tomcat 9.0.87. The vulnerability requires unauthorized callers to bypass SecurityManager restrictions by calling setGlobalContext() without permission checks. The fix (adding a SecurityManager.checkPermission check before allowing global context modification) was applied by upstream Apache in commit 76ebc90075 on January 21, 2016, targeting Tomcat 9.0.0.M3. This f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0763 is not affecting Tomcat 9.0.87. The vulnerability requires unauthorized callers to bypass SecurityManager restrictions by calling setGlobalContext() without permission checks. The fix (adding a SecurityManager.checkPermission check before allowing global context modification) was applied by upstream Apache in commit 76ebc90075 on January 21, 2016, targeting Tomcat 9.0.0.M3. This f..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T10:29:00.052910+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 9.0.87 is NOT affected by CVE-2016-6794. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the configuration file property replacement feature. The fix was authored by Mark Thomas (Apache) in commit c166018201 and was already present in the upstream Tomcat 9.0.87 release that TuxCare onboarded. All three components of the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "impact_statement": "not_affected \u2014 Tomcat 9.0.87 is NOT affected by CVE-2016-6794. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the configuration file property replacement feature. The fix was authored by Mark Thomas (Apache) in commit c166018201 and was already present in the upstream Tomcat 9.0.87 release that TuxCare onboarded. All three components of the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6796 is NOT present in the target. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The fix, which ignores these parameters when SecurityManager is enabled, is already present in the target code at lines 92-96 of JspServlet.java and lines 662-665 of EmbeddedServletOptions.java. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream Apache Tomcat release that TuxCare onboarded for version 9.0.87.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "impact_statement": "CVE-2016-6796 is NOT present in the target. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The fix, which ignores these parameters when SecurityManager is enabled, is already present in the target code at lines 92-96 of JspServlet.java and lines 662-665 of EmbeddedServletOptions.java. This fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream Apache Tomcat release that TuxCare onboarded for version 9.0.87.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.87 is not affected by CVE-2016-6797. The complete fix was already present in the upstream Apache Tomcat 9.0.87 release before TuxCare onboarded it. The ResourceLinkFactory now enforces proper access control: web applications can only access global JNDI resources for which they have explicitly configured ResourceLinks. The fix commit (2859ac3eae) by markt@apache.org shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "impact_statement": "The target Apache Tomcat 9.0.87 is not affected by CVE-2016-6797. The complete fix was already present in the upstream Apache Tomcat 9.0.87 release before TuxCare onboarded it. The ResourceLinkFactory now enforces proper access control: web applications can only access global JNDI resources for which they have explicitly configured ResourceLinks. The fix commit (2859ac3eae) by markt@apache.org shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6817 is not present in Apache Tomcat 9.0.87. The vulnerability (infinite loop when HTTP/2 header exceeds buffer capacity) was fixed in upstream commit 079372fc7b by Mark Thomas in October 2016. The fix adds dynamic buffer expansion logic that prevents the infinite loop condition. This fix was included in the upstream Apache Tomcat 9.0.87 release, which TuxCare later onboarded. The target code contains all three defensive changes from the patch: (1) volatile buffer declaration allowing reassignment, (2) buffer expansion logic in readHeaderPayload(), and (3) buffer reset logic in onHeadersComplete().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "impact_statement": "CVE-2016-6817 is not present in Apache Tomcat 9.0.87. The vulnerability (infinite loop when HTTP/2 header exceeds buffer capacity) was fixed in upstream commit 079372fc7b by Mark Thomas in October 2016. The fix adds dynamic buffer expansion logic that prevents the infinite loop condition. This fix was included in the upstream Apache Tomcat 9.0.87 release, which TuxCare later onboarded. The target code contains all three defensive changes from the patch: (1) volatile buffer declaration allowing reassignment, (2) buffer expansion logic in readHeaderPayload(), and (3) buffer reset logic in onHeadersComplete().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-M15. The target (9.0.87) contains the upstream fix from commit 452c8094a6 (December 2016) by Mark Thomas, first released in 9.0.0-M16. The vulnerable ByteBuffer state management in Http11InputBuffer.nextRequest() has been corrected: the fix adds flip() after compact() and explicit position(0).limit(0) reset, preventing data from one HTTP request from leaking into subsequent requests. This upstream fix predates all TuxCare commits and shipped with the base 9.0.87 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "impact_statement": "CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-M15. The target (9.0.87) contains the upstream fix from commit 452c8094a6 (December 2016) by Mark Thomas, first released in 9.0.0-M16. The vulnerable ByteBuffer state management in Http11InputBuffer.nextRequest() has been corrected: the fix adds flip() after compact() and explicit position(0).limit(0) reset, preventing data from one HTTP request from leaking into subsequent requests. This upstream fix predates all TuxCare commits and shipped with the base 9.0.87 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5647 does not affect Apache Tomcat 9.0.87. The vulnerability (pipelined request loss during sendfile processing) affected versions 9.0.0.M1 to 9.0.0.M18. The fix was applied by Apache upstream in commit 864aa1199a (March 2017, author Mark Thomas) and was already present in the upstream 9.0.87 release that TuxCare onboarded. The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "impact_statement": "CVE-2017-5647 does not affect Apache Tomcat 9.0.87. The vulnerability (pipelined request loss during sendfile processing) affected versions 9.0.0.M1 to 9.0.0.M18. The fix was applied by Apache upstream in commit 864aa1199a (March 2017, author Mark Thomas) and was already present in the upstream 9.0.87 release that TuxCare onboarded. The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.87 is not affected by CVE-2017-5650. The vulnerability, which allowed malicious HTTP/2 clients to exhaust processing threads by sending GOAWAY frames without closing waiting streams, was fixed in upstream Tomcat commits from March 2017. Both components of the fix are present in the target: (1) the goaway() method calls close() to terminate the connection, and (2) the close() method iterates through all streams and resets them via receiveReset(), which releases threads waiting for WINDOW_UPDATE. These fixes were authored by Mark Thomas (markt@apache.org) and were included in the upstream Tomcat 9.0.87 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "impact_statement": "The target Apache Tomcat 9.0.87 is not affected by CVE-2017-5650. The vulnerability, which allowed malicious HTTP/2 clients to exhaust processing threads by sending GOAWAY frames without closing waiting streams, was fixed in upstream Tomcat commits from March 2017. Both components of the fix are present in the target: (1) the goaway() method calls close() to terminate the connection, and (2) the close() method iterates through all streams and resets them via receiveReset(), which releases threads waiting for WINDOW_UPDATE. These fixes were authored by Mark Thomas (markt@apache.org) and were included in the upstream Tomcat 9.0.87 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Tomcat 9.0.87. The vulnerability involved DefaultServlet and WebdavServlet processing error dispatches with their original HTTP method (PUT, DELETE, POST), potentially allowing modification or deletion of static error page files. The fix (commit 7d93527254d9e9371b342800617f20d13c8b85ad by Apache's Mark Thomas in May 2017) was already included in the upstream Tomcat 9.0.87 release that TuxCare onboarded. Both DefaultServlet.java and WebdavServlet.java now check if the dispatcher type is ERROR and force processing through doGet() regardless of the original method, preventing write/delete operations on static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "impact_statement": "CVE-2017-5664 is not present in Tomcat 9.0.87. The vulnerability involved DefaultServlet and WebdavServlet processing error dispatches with their original HTTP method (PUT, DELETE, POST), potentially allowing modification or deletion of static error page files. The fix (commit 7d93527254d9e9371b342800617f20d13c8b85ad by Apache's Mark Thomas in May 2017) was already included in the upstream Tomcat 9.0.87 release that TuxCare onboarded. Both DefaultServlet.java and WebdavServlet.java now check if the dispatcher type is ERROR and force processing through doGet() regardless of the original method, preventing write/delete operations on static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T10:37:32.067867+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is NOT present in Apache Tomcat 9.0.87-tuxcare.6. The vulnerability required the CORS Filter to add a Vary: Origin HTTP header to prevent cache poisoning. The fix was committed upstream by Apache on 2017-05-22 (commit b94478d45b) and was already present in the 9.0.87 release before TuxCare onboarded it. The target uses ResponseUtil.addVaryFieldName(response, REQUEST_HEADER_ORIGIN)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-7674 is NOT present in Apache Tomcat 9.0.87-tuxcare.6. The vulnerability required the CORS Filter to add a Vary: Origin HTTP header to prevent cache poisoning. The fix was committed upstream by Apache on 2017-05-22 (commit b94478d45b) and was already present in the 9.0.87 release before TuxCare onboarded it. The target uses ResponseUtil.addVaryFieldName(response, REQUEST_HEADER_ORIGIN)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-7675 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M21, where HTTP/2 request processing used setString() which bypassed path parameter extraction and security checks. The target version 9.0.87 contains the upstream fix (commit cf181edc9a) that was already included in release 9.0.0-M22. The fix changes URI processing to use setBytes() which ensures path parameters are correctly extracted and security constraint mapping works properly, preventing directory traversal attacks. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "impact_statement": "CVE-2017-7675 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M21, where HTTP/2 request processing used setString() which bypassed path parameter extraction and security checks. The target version 9.0.87 contains the upstream fix (commit cf181edc9a) that was already included in release 9.0.0-M22. The fix changes URI processing to use setBytes() which ensures path parameters are correctly extracted and security constraint mapping works properly, preventing directory traversal attacks. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 is not present in target Tomcat 9.0.87. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache commit 15fcd166 on 2019-04-09, which added HTML entity encoding to the printenv output. This fix was already present in the upstream 9.0.87 release when TuxCare onboarded it. The current code at SSIPrintenv.java:44 uses getVariableValue(varia...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 is not present in target Tomcat 9.0.87. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache commit 15fcd166 on 2019-04-09, which added HTML entity encoding to the printenv output. This fix was already present in the upstream 9.0.87 release when TuxCare onboarded it. The current code at SSIPrintenv.java:44 uses getVariableValue(varia..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:56.766712+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 9.0.87. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, leading to potential HTTP Request Smuggling. The fix (commit 060ecc5eb8) was applied by upstream Apache on 2019-12-17 and is present in the 9.0.87 release that TuxCare onboarded. The current code properly validate...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 is not present in Apache Tomcat 9.0.87. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, leading to potential HTTP Request Smuggling. The fix (commit 060ecc5eb8) was applied by upstream Apache on 2019-12-17 and is present in the 9.0.87 release that TuxCare onboarded. The current code properly validate..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Version 9.0.87 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed and further optimized. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 9.0.87 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed and further optimized. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13935 is not present in Tomcat 9.0.87. The vulnerability affected versions 9.0.0.M1 to 9.0.36, and the fix was included in upstream Apache Tomcat releases after 9.0.36. The target version 9.0.87 shipped with the fix already applied by the upstream vendor (Mark Thomas, markt@apache.org) in commit 40fa74c74822711ab878079d0a69f7357926723d dated 2020-06-29. The fix adds validation in WsFrameBase.java to reject WebSocket frames with negative payload lengths (MSB set in 64-bit extended length field), preventing the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "impact_statement": "CVE-2020-13935 is not present in Tomcat 9.0.87. The vulnerability affected versions 9.0.0.M1 to 9.0.36, and the fix was included in upstream Apache Tomcat releases after 9.0.36. The target version 9.0.87 shipped with the fix already applied by the upstream vendor (Mark Thomas, markt@apache.org) in commit 40fa74c74822711ab878079d0a69f7357926723d dated 2020-06-29. The fix adds validation in WsFrameBase.java to reject WebSocket frames with negative payload lengths (MSB set in 64-bit extended length field), preventing the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 fix was applied by upstream Apache Tomcat in the 9.0.87 release. The vulnerability involved lax HTTP header parsing that could enable request smuggling. The vendor applied a two-phase fix: (1) Jan 2020 commit 8bfb0ff7f2 added strict CRLF parsing and control character rejection; (2) April 2021 commit 70c236bab5 (BZ 65272) refined the fix to accept lone LF as valid while keeping con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 fix was applied by upstream Apache Tomcat in the 9.0.87 release. The vulnerability involved lax HTTP header parsing that could enable request smuggling. The vendor applied a two-phase fix: (1) Jan 2020 commit 8bfb0ff7f2 added strict CRLF parsing and control character rejection; (2) April 2021 commit 70c236bab5 (BZ 65272) refined the fix to accept lone LF as valid while keeping con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.87-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-30639 affects Apache Tomcat versions 10.0.3-10.0.4, 9.0.44, and 8.5.64 due to a missing reset of the errorException field in the Request.recycle() method. The target (version 9.0.87) contains the upstream fix at line 754 of Request.java that properly resets errorException to null when recycling request objects. The fix was authored by Mark Thomas (markt@apache.org) on March 24, 2021 (commit 8ece47c4a9) and was already present in the Apache Tomcat 9.0.87 release when TuxCare onboarded it. The vulnerable pattern (persistent error state across request reuse) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "impact_statement": "CVE-2021-30639 affects Apache Tomcat versions 10.0.3-10.0.4, 9.0.44, and 8.5.64 due to a missing reset of the errorException field in the Request.recycle() method. The target (version 9.0.87) contains the upstream fix at line 754 of Request.java that properly resets errorException to null when recycling request objects. The fix was authored by Mark Thomas (markt@apache.org) on March 24, 2021 (commit 8ece47c4a9) and was already present in the Apache Tomcat 9.0.87 release when TuxCare onboarded it. The vulnerable pattern (persistent error state across request reuse) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:41:00.083121+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 9.0.0.M1 to 9.0.45, allowing authentication bypass via LDAP special characters in usernames. The target version 9.0.87 is NOT affected because the upstream fix was already included in the Apache Tomcat 9.0.87 release that TuxCare onboarded. The vulnerability was fixed by upstream in April 2021 through commits that add RFC 4514 attribute value escaping and RF...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 9.0.0.M1 to 9.0.45, allowing authentication bypass via LDAP special characters in usernames. The target version 9.0.87 is NOT affected because the upstream fix was already included in the Apache Tomcat 9.0.87 release that TuxCare onboarded. The vulnerability was fixed by upstream in April 2021 through commits that add RFC 4514 attribute value escaping and RF..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T04:34:00.136956+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 affects Apache Tomcat 9.0.0.M1 to 9.0.46. The target version (9.0.87) is beyond the affected range and contains all three upstream fixes that were committed on 2021-05-10 and shipped in releases after 9.0.46. The fixes were authored by Mark Thomas (markt@apache.org) and were already present in the upstream Tomcat 9.0.87 release before TuxCare onboarded it. TuxCare backported this...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 affects Apache Tomcat 9.0.0.M1 to 9.0.46. The target version (9.0.87) is beyond the affected range and contains all three upstream fixes that were committed on 2021-05-10 and shipped in releases after 9.0.46. The fixes were authored by Mark Thomas (markt@apache.org) and were already present in the upstream Tomcat 9.0.87 release before TuxCare onboarded it. TuxCare backported this..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2021-41079 affects Apache Tomcat versions 8.5.0-8.5.63, 9.0.0-M1 to 9.0.43, and 10.0.0-M1 to 10.0.2. The target is version 9.0.87, which is significantly newer than the affected range. The vulnerability involves two infinite loop conditions in OpenSSLEngine.unwrap() when processing specially crafted TLS packets with NIO+OpenSSL or NIO2+OpenSSL. Both fixes were applied by Apache upstream committers (remm@apache.org on 2021-01-21 and markt@apache.org on 2021-03-03) and were already present in the upstream release 9.0.87 before TuxCare onboarding. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "impact_statement": "CVE-2021-41079 affects Apache Tomcat versions 8.5.0-8.5.63, 9.0.0-M1 to 9.0.43, and 10.0.0-M1 to 10.0.2. The target is version 9.0.87, which is significantly newer than the affected range. The vulnerability involves two infinite loop conditions in OpenSSLEngine.unwrap() when processing specially crafted TLS packets with NIO+OpenSSL or NIO2+OpenSSL. Both fixes were applied by Apache upstream committers (remm@apache.org on 2021-01-21 and markt@apache.org on 2021-03-03) and were already present in the upstream release 9.0.87 before TuxCare onboarding. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', b94ecd1b69 'Make asynchronous error handling more robust.')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', b94ecd1b69 'Make asynchronous error handling more robust.')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T01:39:00.185420+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60. The target version 9.0.87 is outside the affected range. The vulnerability involves a concurrency bug where client connections could share Http11Processor instances, causing responses to be delivered to wrong clients. The fix uses atomic operations (AtomicReference and takeCurrentProcessor) to ensure exclusive processor ownership during request ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60. The target version 9.0.87 is outside the affected range. The vulnerability involves a concurrency bug where client connections could share Http11Processor instances, causing responses to be delivered to wrong clients. The fix uses atomic operations (AtomicReference and takeCurrentProcessor) to ensure exclusive processor ownership during request ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:40.381958+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-23181 (TOCTOU vulnerability in FileStore session persistence) is NOT present in Apache Tomcat 9.0.87. The vulnerable pattern was removed by an upstream fix (commit 1385c624b4) authored by Mark Thomas (markt@apache.org) on 2022-01-12, which was already included in the upstream 9.0.87 release before TuxCare onboarding. The fix eliminates the time-of-check-time-of-use race condition by computing the canonical file path once, validating it, and returning the same validated canonical file for all subsequent operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "impact_statement": "CVE-2022-23181 (TOCTOU vulnerability in FileStore session persistence) is NOT present in Apache Tomcat 9.0.87. The vulnerable pattern was removed by an upstream fix (commit 1385c624b4) authored by Mark Thomas (markt@apache.org) on 2022-01-12, which was already included in the upstream 9.0.87 release before TuxCare onboarding. The fix eliminates the time-of-check-time-of-use race condition by computing the canonical file path once, validating it, and returning the same validated canonical file for all subsequent operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.87 is NOT affected by CVE-2022-25762. The vulnerability (use-after-close of sockets during concurrent WebSocket operations leading to double-pooling corruption) was fixed by upstream Apache in versions 9.0.21 and 9.0.34, well before the 9.0.87 release. The CVE affects versions 9.0.0.M1 to 9.0.20. All fix components are present in 9.0.87: (1) double-close pattern removed, (2) CLOSED_NIO_CHANNEL sentinel introduced, (3) pre-operation closed-state checks added. No TuxCare backport was required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "impact_statement": "Apache Tomcat 9.0.87 is NOT affected by CVE-2022-25762. The vulnerability (use-after-close of sockets during concurrent WebSocket operations leading to double-pooling corruption) was fixed by upstream Apache in versions 9.0.21 and 9.0.34, well before the 9.0.87 release. The CVE affects versions 9.0.0.M1 to 9.0.20. All fix components are present in 9.0.87: (1) double-close pattern removed, (2) CLOSED_NIO_CHANNEL sentinel introduced, (3) pre-operation closed-state checks added. No TuxCare backport was required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only issue where Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks. The target repository (version 9.0.87) contains the CORRECTED documentation that properly warns EncryptInterceptor only provides confidentiality and integrity protection but does NOT protect against DoS attacks. The fix was authored by Mark Thomas (upstream Apache) on 2022-05-10 and shipped in the upstream 9.0.87 release that TuxCare onboarded on 2025-12-02. No vulnerable (misleading) documentation pattern is present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "impact_statement": "CVE-2022-29885 is a documentation-only issue where Apache Tomcat documentation incorrectly stated that EncryptInterceptor enabled safe clustering over untrusted networks. The target repository (version 9.0.87) contains the CORRECTED documentation that properly warns EncryptInterceptor only provides confidentiality and integrity protection but does NOT protect against DoS attacks. The fix was authored by Mark Thomas (upstream Apache) on 2022-05-10 and shipped in the upstream 9.0.87 release that TuxCare onboarded on 2025-12-02. No vulnerable (misleading) documentation pattern is present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 affects Apache Tomcat 9.0.30-9.0.64. Target version 9.0.87 is not affected because the upstream Apache vendor already fixed the XSS vulnerability in the Form authentication example. The fix (commit 8b60af90b9 by markt@apache.org, June 23, 2022) adds HTML filtering via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. Thi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 affects Apache Tomcat 9.0.30-9.0.64. Target version 9.0.87 is not affected because the upstream Apache vendor already fixed the XSS vulnerability in the Form authentication example. The fix (commit 8b60af90b9 by markt@apache.org, June 23, 2022) adds HTML filtering via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. Thi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T19:06:21.253116+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533 (already in target via 2b6287521b 'Add support for JSON responses to request header example.')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "impact_statement": "Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533 (already in target via 2b6287521b 'Add support for JSON responses to request header example.')"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:30:36.061493+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.87 is not affected by CVE-2026-29129. The CVE affects only versions 9.0.114-9.0.115, indicating a regression introduced in 9.0.114 and fixed in 9.0.116. Version 9.0.87 is 27 minor versions older than the affected range. Code analysis confirms that cipher ordering is correctly implemented in 9.0.87: the honorCipherOrder configuration is properly applied via SSLParameters.setUse...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.87 is not affected by CVE-2026-29129. The CVE affects only versions 9.0.114-9.0.115, indicating a regression introduced in 9.0.114 and fixed in 9.0.116. Version 9.0.87 is 27 minor versions older than the affected range. Code analysis confirms that cipher ordering is correctly implemented in 9.0.87: the honorCipherOrder configuration is properly applied via SSLParameters.setUse..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-50229 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-50229"
      },
      "action_statement": "Vulnerability CVE-2026-50229 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:42:00.050702+00:00",
      "status_notes": "Vulnerability CVE-2026-55955 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55955"
      },
      "action_statement": "Vulnerability CVE-2026-55955 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    }
  ]
}