{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f16871ae-0120-5fb5-969a-88d856c4dfa1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2",
      "version": "10.1.55-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5388",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d2d39d45-93c7-5530-a2fe-9351e9670f19",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5388 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target Apache Tomcat 10.1.55 is not affected by CVE-2016-5388 (httpoxy). The upstream fix by Mark Thomas (commit fb3569fbb9) was already present in the Apache Tomcat 10.1.55 release when TuxCare onboarded it. The vulnerable blacklist pattern that allowed arbitrary HTTP headers (including \"Proxy\") to be passed as environment variables to CGI processes has been replaced with a whitelist pattern that explicitly excludes the \"Proxy\" header. The fix uses envHttpHeadersPattern regex to allow only safe headers (ACCEPT*, CACHE-CONTROL, COOKIE, HOST, IF-*, REFERER, USER-AGENT), preventing HTTP_PROXY environment variable injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:adeb3bb0-fff2-5950-ac8f-619cf4722df1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 10.1.55 is not affected by CVE-2016-8735. The vulnerable component JmxRemoteLifecycleListener was removed by Apache in January 2020 (commit 46fbf32e55), well before the target version was released. The class removal was part of Tomcat 10's architectural changes, as the JRE's built-in remote JMX capability now provides the same functionality with proper security controls. No alternative code path in the target implements the vulnerable JMX remote server setup pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:91b9c7c1-dc4b-5b35-9066-deed199e2e1c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12616 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Tomcat 10.1.55 is not affected by CVE-2017-12616. The vulnerable classes (VirtualDirContext and FileDirContext from org.apache.naming.resources package) do not exist in this version. They were removed in Tomcat 8.0 (October 2012, commit 527baba173) and replaced with a new WebResourceRoot architecture that includes built-in path validation to prevent directory traversal attacks. The replacement classes (DirResourceSet, AbstractFileResourceSet) validate that all file paths remain within the allowed base directory through canonical path checking, which is the same defense the CVE-2017-12616 patch added to the vulnerable classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12617",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a10e5353-fb61-58e5-8a2b-198545923744",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12617 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is not present in Tomcat 10.1.55. The vulnerability affects Tomcat 7.0.0-7.0.81, 8.0.0.RC1-8.0.46, 8.5.0-8.5.22, and 9.0.0.M1-9.0.0. The fix was already included in the upstream Apache Tomcat release that TuxCare onboarded. The vulnerable pattern (missing validation of trailing slashes in file paths during HTTP PUT operations) has been mitigated by upstream patches authored by Mark Thomas in September 2017 that validate paths before file creation operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a503b2b7-07ba-5ae1-9d28-fa0a51af0a3b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5648 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 affects Apache Tomcat versions 7.0.0-7.0.75, 8.0.0.RC1-8.0.41, 8.5.0-8.5.11, and 9.0.0.M1-9.0.0.M17. The vulnerability was fixed upstream in March 2017 (commit dfa40863 by Mark Thomas) and included in all subsequent releases. The target version 10.1.55 already contains the fix in its upstream release: all calls to fireRequestInitEvent() and fireRequestDestroyEvent() use the facade pattern (request.getRequest()) rather than passing internal request objects directly to application listeners. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:329887b9-a2b2-5679-ba23-e36c35675377",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes environment variables without escaping, enabling XSS. The target (Apache Tomcat 10.1.55) is NOT AFFECTED because the upstream fix (commit 15fcd166ea by Mark Thomas) is already present, having shipped in the upstream 10.1.55 release that TuxCare onboarded. The fix adds HTML entity encoding via SSIMediator.ENCODING_ENTITY parameter to es...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-9484",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:98fa5829-8c8d-5b11-b872-94ae513d9376",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-9484 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2020-9484 is a path traversal vulnerability in Tomcat's FileStore that allows attackers to trigger deserialization of arbitrary files when conditions a-d are met (attacker controls file content/name, FileStore is enabled, lax filter, known file path). Apache Tomcat 10.1.55 is NOT AFFECTED because the fix (commit 6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4) was already included in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The fix validates that file paths constructed from session IDs remain within the storage directory boundary using Path.startsWith() canonicalization checks, preventing path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2fad8ff3-6e34-576d-9a48-75d7b956d33d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target version 10.1.55 is NOT affected by CVE-2022-45143. The vulnerability concerns missing JSON escaping in JsonErrorReportValve's type, message, and description fields, allowing JSON injection attacks. The fix (commit 1f50bff8da by Mark Thomas, dated 2022-11-09) that adds JSONFilter.escape() calls was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded this version. The CVE affects versions 10.1.0-M1 to 10.1.1; version 10.1.55 is significantly later and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e9b08008-2473-54d1-8dec-a4ecf9c78bb9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2023-24998 (DoS via unbounded multipart request parts) is NOT present in Tomcat 10.1.55. The upstream Apache Tomcat fix was already included in the 10.1.55 release that TuxCare onboarded. The fix adds FileUploadBase.setFileCountMax() and checks items.size() == fileCountMax before processing each part, throwing FileCountLimitExceededException when the limit is exceeded. Request.parseParts() applies this limit by computing partLimit from maxParameterCount and maxPartCount. All fix components (FileUploadBase defense check, Request integration, Parameters.size() method, FileCountLimitExceededException class) are present in the target at the authoritative SHA c5b492c1bfe321aa1526c142774a77d53804c197.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28708",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0f67f039-4263-545a-b716-877b11d623ca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2023-28708. The vulnerability (missing Secure attribute on session cookies when RemoteIpFilter processes X-Forwarded-Proto: https) was fixed in upstream Tomcat commit f509bbf31f (Feb 2023) by lihan@apache.org. This fix was already present in upstream release 10.1.55 when TuxCare onboarded it (Sep 2026). The CVE affected versions 10.1.0-M1 to 10.1.5;...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f1b3f6a7-07cf-5aa1-a594-1eeb355febbe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:84c1a8e2-ff9b-5ed6-b041-fd5f80fa3e3d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3d5f2aff-de61-59e4-a778-4834dcd62b5d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target Apache Tomcat 10.1.55 is not affected by CVE-2023-46589. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed upstream by Apache in October-November 2023 and shipped in Apache Tomcat 10.1.16+. The target version 10.1.55 was onboarded by TuxCare from the upstream release, which already contained the fix in refactored form: (1) HttpHeaderParser validates trailer header names using HttpParser.isToken() and values using HttpParser.isControl() checks, rejecting malformed headers; (2) InputBuffer.handleReadException() ensures IOExceptions during request reading set error flags to prevent request boundary confusion. Original CVE fix commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 (2023-10-05) by markt@apache.org was later refactored into HttpHeaderParser (a5a7c112505b471e943967fd33c72299cbe6bb9f, 2024-04-26), both predating the first TuxCare onboarding commit df13cfd2cca80866443a0ebeb3873a17370617a9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-50379",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8efb6bef-4f64-52c8-9b8f-ef4ee2f97695",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50379 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.55 already contains the complete upstream fix for CVE-2024-50379 (TOCTOU race condition in JSP compilation). The fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream 10.1.55 release. The target repository shows WebResourceLockSet interface, DirResourceSet locking implementation, and FileResource delete() protection all present at HEAD (3ebb4d5aea), which is the onboarding of upstream 10.1.55. The vulnerable pattern (unsynchronized file metadata access during concurrent reads/writes) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52316",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:51a43047-b518-5e3c-a0d8-e2553165999f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2024-52316 affects Apache Tomcat 10.1.0-M1 through 10.1.30. The target is version 10.1.55, which already contains the upstream fix authored by Mark Thomas in commit acc2f01395. The fix adds explicit HTTP 500 status setting when Jakarta Authentication fails with an exception, preventing authentication bypass. This fix shipped in upstream release 10.1.31 and was included when TuxCare onboarded version 10.1.55.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-56337",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:760f9277-9972-5114-8dc5-39cc566ad0ec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-56337 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target Apache Tomcat 10.1.55 is not vulnerable to CVE-2024-56337. The upstream Apache Tomcat 10.1.55 release already included the complete CVE-2024-56337 mitigation before TuxCare onboarded it. The fix includes: (1) JVM flag -Dsun.io.useCanonCaches=false set in startup scripts, (2) runtime validation in DirResourceSet.initInternal() that verifies the protection and throws exceptions if it cannot be enabled, (3) path normalization that always converts lock keys to lowercase, and (4) read/write locking from CVE-2024-50379. Fix authored by Mark Thomas (markt@apache.org) from Apache, shipped in upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-24813",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:067b8782-409d-5bfb-83f8-118278ac8f01",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-24813 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target repository (Tomcat 10.1.55) is NOT AFFECTED by CVE-2025-24813. The vulnerability pattern (predictable temp file naming via path.replace('/', '.')) does not exist in the target code. The fix was already present in upstream Apache Tomcat 10.1.55 before TuxCare onboarded it. The target uses File.createTempFile() which generates cryptographically random temp file names, eliminating the path equivalence vulnerability. Fix commit f6c01d6577 by remm@apache.org was already in the upstream release when TuxCare imported version 10.1.55.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c3b544d6-37ff-5bdb-9784-4ce140cba9e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31651 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-31651 is NOT present in Apache Tomcat 10.1.55. The vulnerability affected versions 10.1.0-M1 through 10.1.39, and was fixed in upstream version 10.1.40. The target version 10.1.55 includes the complete upstream fix authored by Mark Thomas (markt@apache.org) in commit 066bf6b6a1, which was part of the upstream release onboarded by TuxCare. The fix adds encodeForRewrite() to properly encode literal '%', ';', and '?' characters before rewrite rule evaluation, preventing bypass attacks through URL manipulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-46701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:119d791e-dc23-5a1e-812f-7647c8d96aee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-46701 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.55 is NOT affected by CVE-2025-46701. The vulnerability (improper file/directory differentiation in CGI servlet's pathInfo parsing that allows security constraint bypass) was fixed in upstream Apache Tomcat commit 238d2aa (2025-05-02) by Mark Thomas. This fix was already present in the upstream 10.1.55 release (2026-05-05) when TuxCare onboarded it (2026-09-22). The target code uses WebResource API with explicit isFile() checks (lines 819, 832), preventing directories from being mistaken for CGI script files. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48988",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ac4af21a-4af6-5665-95c2-b1b7067563d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48988 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fc98ae8f-7b16-59eb-83dc-b93a26e3d9fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49124 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-49124 affects Apache Tomcat's Windows installer due to untrusted PATH search when calling icacls.exe. The target version (10.1.55) is newer than the fixed version (10.1.42). Analysis confirms the fix (using $SYSDIR\\icacls instead of icacls) was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded it. The vulnerable pattern (unqualified icacls calls) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49125",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4479076b-136e-59e3-928d-1162b719cf9e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-49125 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-52520",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e0484e81-5dd6-5cc8-8a7e-8aeb86789e32",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52520 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2025-52520 (integer overflow in multipart upload size tracking) is NOT present in Apache Tomcat 10.1.55. The upstream fix by Mark Thomas (commit fc42bbccb9) was already included in the 10.1.55 release that TuxCare onboarded. The vulnerable pattern (32-bit int accumulator allowing wraparound to bypass maxPostSize) has been replaced with 64-bit long and Math.addExact() overflow detection at java/org/apache/catalina/connector/Request.java:2677-2693.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 11.0.0-M1, < 11.0.9; >= 10.1.0-M1, < 10.1.43; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107; >= 10.1.0, < 10.1.43; >= 11.0.0, < 11.0.9), cve.org (>= 11.0.0-M1, <= 11.0.8; >= 10.1.0-M1, <= 10.1.42; >= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9; >= 9.0.0.M1, < 9.0.107; >= 10.0.0-M1, < 10.1.43; >= 11.0.0-M1, < 11.0.9).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55668",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7760ecbc-4e1a-559a-a75f-1ca2ff923d0a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55668 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2025-55668. The session fixation vulnerability in the rewrite valve was fixed in upstream Apache Tomcat 10.1.42, and version 10.1.55 ships with this fix already applied. Both critical defense mechanisms are present: (1) redirect URLs are properly encoded with session IDs via response.encodeRedirectURL() at line 474, and (2) session information is re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6ce46afa-6957-516e-beaf-daafb1a7ddd0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target version 10.1.55 is not affected by CVE-2025-55752. The vulnerability (normalizing before decoding URL-encoded path components, allowing encoded traversal sequences to bypass security checks for /WEB-INF/ and /META-INF/) was fixed in upstream Apache Tomcat 10.1.45. The fix commit (130d36d8492ef9e4eb22952c17c92423cb35fd06) was already present in the upstream 10.1.55 release that TuxCare onboarded. The RewriteValve.java code at lines 560-563 shows the correct fixed pattern: decode THEN normalize, preventing encoded path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.0-M11, < 9.0.109; >= 8.5.6, <= 8.5.100), NVD (>= 8.5.6, <= 8.5.100; >= 9.0.1, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11; = 9.0.0; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.0.M11, <= 9.0.108; >= 8.5.6, <= 8.5.100), Snyk (< 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11; < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:13287ee6-1877-5042-88d6-2d13967b9d61",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-55754 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 10.1.55 is NOT affected by CVE-2025-55754. The vulnerability (unescaped ANSI control characters in log output) is not present because the upstream vendor's fix was already included in the Apache Tomcat 10.1.55 release. The fix adds LogUtil.escape() which converts control characters to \\uNNNN format before logging, preventing ANSI escape sequence injection attacks on Windows consoles. All production log formatters (JdkLoggerFormatter, OneLineFormatter, JsonFormatter) properly escape control characters. VerbatimFormatter intentionally does not escape (documented design for access logs).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100; >= 11.0.0-M1, < 11.0.11; >= 10.1.0-M1, < 10.1.45; >= 9.0.40, < 9.0.109; >= 8.5.60, <= 8.5.100), NVD (>= 8.5.60, <= 8.5.100; >= 9.0.40, < 9.0.109; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.45; >= 11.0.0, < 11.0.11), cve.org (>= 11.0.0-M1, <= 11.0.10; >= 10.1.0-M1, <= 10.1.44; >= 9.0.40, <= 9.0.108; >= 8.5.60, <= 8.5.100), Snyk (>= 9.0.0.40, < 9.0.109; >= 10.1.0-M1, < 10.1.45; >= 11.0.0-M1, < 11.0.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6014bdf3-8d35-5544-ad46-5b2a3ba03f9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-61795 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:80e7f9c6-a571-5bfa-b5dc-e8108fdca001",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-25854 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5decd6bf-b383-57d8-82ea-1af770c138dc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34483 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.55 is not affected by CVE-2026-34483. The vulnerability (improper encoding/escaping of URI and query strings in JsonAccessLogValve) was fixed in upstream Apache Tomcat 10.1.54 (commit f22dc2ce6c by Mark Thomas). Version 10.1.55 already contains this fix from the upstream release. All URI and query string values are properly escaped via escapeAndAppend() before being written to access logs, preventing log injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.40, < 9.0.116; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.40, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.40, <= 9.0.116; >= 8.5.84, <= 8.5.100), Snyk (< 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:454c5039-680d-5e6b-b1fc-5bc092eeecf5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41284 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target (Apache Tomcat 10.1.55) is not affected by CVE-2026-41284. The fix for unbounded WebDAV request body buffering was already present in the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded. The vulnerable pattern (unbounded ByteArrayOutputStream) has been replaced with BoundedByteArrayOutputStream enforcing a 4096-byte default limit on LOCK and PROPFIND request bodies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 4.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.0.0, <= 10.0.27; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 10.0.0-M1, <= 10.0.27; >= 8.5.0, <= 8.5.100; >= 4.0, <= 7.0.109), Snyk (>= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 9.0.0.M1, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:35b6d338-4c44-5cff-8ddf-d0c755d4e9e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42498 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target repository at version 10.1.55 is not affected by CVE-2026-42498. The vulnerability involves WebSocket authentication credentials being leaked to redirect target hosts. The fix, which removes authentication headers after successful authentication or redirects, was authored by upstream Apache (Mark Thomas, markt@apache.org) and shipped in the Apache Tomcat 10.1.55 release. This fix is present in the target repository as commit 6cbe274592, which predates all TuxCare commits. The CVE itself states that version 10.1.55 is the fixed version (affected: 10.1.0-M1 to 10.1.54).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.2, <= 9.0.117; >= 8.5.24, <= 8.5.100; >= 7.0.83, <= 7.0.109), Snyk (>= 7.0.83, < 8.0.1; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; >= 8.5.24, < 9.0.0.M1; >= 9.0.2, < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:28cf1752-72f9-5689-907a-cf4531c08467",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43512 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.55 is not vulnerable to CVE-2026-43512. The fix was included in the upstream Apache Tomcat 10.1.55 release (the first fixed version per CVE). The vulnerable pattern - where null passwords from non-existent users were converted to the string \"null\" in DIGEST authentication digest calculations - is not present. Upstream commit 3d4d3fae07 by Mark Thomas (markt@apache.org) added a null check that immediately returns null from getDigest() when getPassword() returns null, preventing the authentication bypass. This fix shipped in the upstream 10.1.55 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e1d0d902-7ad5-57ae-bedd-dfc90dd3ea44",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43513 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 10.1.55 repository is not affected by CVE-2026-43513. The vulnerability (improper handling of case sensitivity in LockOutRealm allowing lockout bypass via case-variant usernames) has been fixed by upstream commit 4a90d3fa93, which was already included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. The fix adds username normalization to lowercase (when caseSensitive=false, the default) in all three critical methods: isLocked(), registerAuthSuccess(), and registerAuthFailure().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d8ed2c6b-79e6-5dd7-829a-6684589eb0cd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43514 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:70087695-412b-5457-8e72-8bf57eb0ab03",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-43515 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2026-43515 is NOT present in Apache Tomcat 10.1.55. The vulnerability (only first HTTP method constraint applied for extension patterns) was fixed by upstream Apache in commit c621317382682206fb58ab92ebd3e1b6fdd10ce9 by Mark Thomas, which shipped in the 10.1.55 release. The target code has the fixed pattern: 'matched' variable declared inside the collection loop, checking collection[j].findMethod(method) for each matching collection rather than only collection[pos] after the loop. TuxCare onboarded 10.1.55 with this upstream fix already present. CVE states fixed in 10.1.55+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.1.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22), NVD (>= 7.0.0, <= 7.0.109; >= 8.5.0, <= 8.5.100; >= 9.0.0, < 9.0.118; >= 10.1.0, < 10.1.55; >= 11.0.0, < 11.0.22), cve.org (>= 11.0.0-M1, <= 11.0.21; >= 10.1.0-M1, <= 10.1.54; >= 9.0.0.M1, <= 9.0.117; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109), Snyk (< 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22; < 9.0.118; >= 10.0.0-M1, < 10.1.55; >= 11.0.0-M1, < 11.0.22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8206f47c-b8a6-5204-9070-441c4c6bcd57",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f475b9e0-a3dc-5a60-8163-544354826b2e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e80eff75-054a-54a0-b076-ec21268a9495",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4ac68346-b46d-5389-b07e-e6052e8d5633",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d3422351-540d-50ee-b757-da9096515238",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5ce3c67b-03fb-5dec-82ee-dc8701149cb8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-catalina."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.55-tuxcare.2"
    }
  ]
}