{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b3910dff-c593-5307-98b6-9e50f8620cd4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2",
      "version": "10.1.16-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f588ce4e-c24a-539d-b3cb-77b8971a5fc7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 describes a denial-of-service vulnerability in Apache Tomcat 8.x before 8.0.4 where AJP requests with Content-Length: 0 caused thread consumption by triggering a hang in request processing. The target version (Apache Tomcat 10.1.16) is NOT affected because the fix was already present in the upstream release 10.1.16 that TuxCare onboarded. The fix commit (8884dae60ac by Mark Thomas...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:967689b6-6ee2-5b9b-bb46-8ac05f9e3c8e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is NOT present in Apache Tomcat 10.1.16. The vulnerability was fixed upstream in November 2016 (commits f96f5751, 516bda67, cdc0a935 by Mark Thomas) across all maintained Tomcat branches (6.x through 9.x). Apache Tomcat 10.1.x was created years later (~2021) for Jakarta EE 9+ support and inherited the fix from the 9.x branch. The target's onboarded version 10.1.16 contains the complete fix: HttpParser.isNotRequestTarget() and HttpParser.isHttpProtocol() methods validate request line characters per RFC 7230/3986, rejecting invalid characters before processing. This is an upstream fix present in the released version, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8; >= 8.0.0RC1, < 8.0.39; >= 7.0.0, < 7.0.73; >= 6.0.0, < 6.0.48), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 8.0.0; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6; >= 8.0.0.RC1, <= 8.0.38; >= 7.0.0, <= 7.0.72; >= 6.0.0, <= 6.0.47; < 6.0.0), Snyk (>= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:df75c226-8e3d-5dd5-bcd4-b36e393aabad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 affected Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 due to a regression in HTTP connector refactoring where sendfile processing completing quickly could cause a Processor to be added to the processor cache twice, leading to the same Processor being used for multiple requests and causing response mix-up. The target version is Tomcat 10.1.16. The vulnerability fix (bug 60918) was applied by Mark Thomas (markt@apache.org) in March 2017 to the Tomcat 9.x codebase. Tomcat 10.x, released in 2020, inherited this fix from Tomcat 9.x. Analysis confirms all fix patterns are present in the target code: SendfileState enum tracking, processSendfile() method returning SendfileState, loop condition checking sendfileState == SendfileState.DONE, and removal of premature sendfileData clearing. The fix commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 is an ancestor of HEAD and was present in the upstream Tomcat 10.1.16 release before TuxCare onboarded it (first TuxCare commit: e1463febbc3e1eee03c0ab70053f4c612e8a66e0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:18dfdbb4-bb55-58b7-90ee-e669c66e0a17",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 is not present in Apache Tomcat 10.1.16-tuxcare.1. All three defense mechanisms (stream read timeout, stream write timeout, and overhead frame tracking) were added by upstream Apache Tomcat in February 2019 (commits c38033338a and f9d8c2591f by Mark Thomas) and are part of the upstream 10.1.16 release that TuxCare onboarded. The vulnerable pattern (missing timeouts and unlimited overhead frame acceptance) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d982cee0-c29f-55a8-b2a0-b8a149217f4b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, and 8.5.1 to 8.5.56 due to a resource leak when handling direct h2c connections. The target version 10.1.16 is not affected because the upstream fix (commit c9167ae30f) was already present in the 10.1.16 release. The fix adds a release(processor) call to properly recycle the HTTP/1.1 processor before creating the HTTP/2 upgrade processor, preventing memory exhaustion from accumulated unreleased processor objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b0e19a57-6e3c-57d7-a7c5-92c8e324f395",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2020-13943 affects HTTP/2 header parsing when concurrent stream limits are exceeded. The vulnerability existed when the concurrent stream validation check was performed in headersStart() BEFORE headers were fully parsed, allowing rejected streams' headers to leak into subsequent requests. The fix moved this check to headersEnd() AFTER complete header parsing. The target repository (Tomcat 1...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b6f88bef-b201-5652-ac45-c0164cb40d06",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527 (HTTP/2 header value reuse vulnerability) is NOT present in Apache Tomcat 10.1.16. The vulnerability affected versions 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39, and 8.5.0 to 8.5.59. The target version 10.1.16 already contains all three upstream fixes from BZ 64830, applied by Apache developer Mark Thomas in November 2020 and January 2021. These fixes were included in the upstream 10.1.16 release that TuxCare onboarded in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f2f76da0-3268-59e2-9cb6-367414b63c89",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 affects Apache Tomcat when responding to h2c (HTTP/2 cleartext) connections due to concurrency issues that could cause request data from one user to leak into another user's request. The target version 10.1.16 is not vulnerable because all upstream fixes were already present in the Apache Tomcat 10.1.16 release that TuxCare onboarded. The fixes include: (1) HpackDecoder using local StringBuilder instead of shared instance field, (2) ConnectionSettingsBase using ConcurrentHashMap instead of EnumMap for thread safety, and (3) AbstractProtocol properly ordering leftover input restoration before upgrade processor creation. All fix commits are authored by Mark Thomas (markt@apache.org) from Apache upstream and predate TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:298c54e4-a1bc-58c5-9e11-d1b2c8276350",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2022-42252 affects Apache Tomcat versions 8.5.0-8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, and 10.1.0-M1 to 10.1.0. The target repository is at version 10.1.16, which is higher than the affected range (10.1.0). The vulnerability involved Tomcat accepting HTTP requests with malformed Content-Length headers when rejectIllegalHeader was set to false, enabling request smuggling attacks. The fix (commit c9fe754e5d by Mark Thomas, Oct 3 2022) adds special logic to Http11InputBuffer.skipLine() that forces rejection of any Content-Length header containing invalid characters, regardless of the rejectIllegalHeader configuration. This upstream fix was already present in Apache Tomcat 10.1.16 when TuxCare onboarded it (commit e1463febbc3e by ikashchyeyev@cloudlinux.com). The target is not affected because the vulnerable code pattern was removed by the upstream vendor before the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:858859ee-e103-5ba9-8b47-7688c388d60f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2023-24998 fix was already present in upstream Apache Tomcat 10.1.16 release. The vulnerability concerns unbounded file upload part processing in Commons FileUpload. The fix adds fileCountMax enforcement to limit the number of file parts processed per request. In Tomcat 10.1.16, this defense is active by default via maxParameterCount=10000. The fix was authored by upstream Apache developer Mark Thomas and shipped with the 10.1.16 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9a24ff19-f7db-59f9-b76d-928432e846e8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2023-28709 is NOT present in Apache Tomcat 10.1.16. The vulnerability (an off-by-one error in parameter counting that allowed bypassing maxParameterCount when exactly that many query parameters were sent) was fixed upstream by Mark Thomas in commit ba848da71c5 on April 11, 2023, released in Tomcat 10.1.8. Since the target version 10.1.16 was released after 10.1.8, it already contains the upstream fix. The vulnerable code pattern (checking limit after incrementing counter) has been replaced with the secure pattern (checking before incrementing, using >= instead of >).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:25b21163-c2f8-5de4-bb0f-368397a5624a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.16 is not affected by CVE-2023-34981. This CVE describes a regression in bug 66512's fix where responses with no HTTP headers would not send an AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests (information leak). The fix for this regression (bug 66591) was committed upstream by Mark Thomas on May 3, 2023, and first included in Apache Tomcat 10.1.10. The target version 10.1.16 (released November 10, 2023) already contains this upstream fix in the prepareResponse() method, which uses a while loop with needAjpMessageHeader flag to ensure SEND_HEADERS is always sent regardless of header count.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2792d769-24b7-5da3-9bb2-903f4c9f7164",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 does not affect Tomcat 10.1.16. Apache lists it only for 8.5.85-8.5.93 and 9.0.70-9.0.80, fixed in 8.5.94 and 9.0.81 by commits c99ffc30 and 43b882b8, which restore DiskFileItem.finalize(). In those versions getInputStream() opens the upload's temp file with FileInputStream, which on Windows blocks deleting the file while the application leaves the stream open, so the file is never deleted. In 10.1.16, getInputStream() uses Files.newInputStream, which opens the file with delete sharing, so the delete at the end of the request succeeds and the file is gone once the leaked stream is closed or garbage-collected. finalize() is not needed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dede6b99-c3dd-51f2-aae3-269a4290ca87",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Tomcat 10.1.16. The upstream Apache Tomcat fix was already included in the 10.1.16 release (Nov 2023) when TuxCare onboarded it. The defense tracks RST_STREAM frames using an overhead counter (incremented by factor 50 per RST) and closes the connection when the overhead limit is exceeded, preventing resource exhaustion from rapid stream resets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3148dc31-0be0-5c8c-89e9-ddf9ba0d4296",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:04a59986-b42e-5cd0-b69f-25a252a697c6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-46589. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.15, and version 10.1.16 is the first upstream release containing the fix. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 8ecff306 on 2023-10-05 and was already present in the upstream 10.1.16 release when TuxCare onboarded it. Both the primary fix (trailer header validation in ChunkedInputFilter) and secondary defensive measure (error handling in InputBuffer) are present in the target at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cb13a7b7-755f-57fd-ab9e-9cbda79db036",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Tomcat 10.1.16 is not affected by CVE-2024-21733. The vulnerability involves generation of error messages containing sensitive information when I/O operations are attempted after connections are closed. The target already contains both upstream fixes: (1) ErrorReportValve.java checks IS_IO_ALLOWED before attempting to flush error responses (commit ce4f9a5e0e2, 2021-02-24), and (2) Http11InputBu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ffc0b5c4-1d80-5369-8dc1-cb5b4eca1f97",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4768e871-af5d-5e0e-ad89-690434c6eeee",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:35a6097f-c4d8-53b5-a651-f5fafc7f309a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:da90dfc8-5e48-5e6e-bf66-c1af33abcb02",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Version 10.1.16 is not affected by CVE-2024-52317. The vulnerability requires HTTP/2 request/response pooling and recycling mechanisms that were introduced in version 10.1.27 (July 2024). Version 10.1.16 lacks the vulnerable code pattern entirely: its Stream.recycle() method only calls handler.replaceStream() and does not recycle or pool coyoteRequest/coyoteResponse objects. The CVE's affected ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05466700-a5f0-5a51-a796-022303c4b334",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2edc22eb-329e-5dc7-ad85-3e2dde9c6f83",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee59a703-e5e0-5e9b-9f01-1012af1230d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52434 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2025-52434. The vulnerable component (APR/Native connector and AprEndpoint.java) does not exist in this version. The APR/Native connector was removed from Apache Tomcat in version 10.1.0-M5 (released September 2021), before version 10.1.16 was released. The vulnerability specifically affects the APR/Native connector's race condition handling, but version 10.1.16 only includes NIO and NIO2 connectors, making it immune to this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d68a3ecb-b8be-5a95-8bdb-765757fbf2ce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:89b77487-8b32-5589-96cc-c6703a32e91b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bcf217dd-b057-55df-801e-63c2c42ba74f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9e1e364a-282a-5b4a-8033-a41b827ba5e3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24734 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:36356417-1326-52d4-b494-4053f7b4561c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24880 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:209aba1c-1c01-5242-a02f-aab083ec366c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 10.1.16 does not contain the vulnerable code pattern. The CVE-2026-29129 vulnerability was introduced in later versions (10.1.51+, 9.0.114+, 11.0.16+) when TLS 1.3 cipher suite support was added via commit 4ee45c557168 on 2026-01-06. That commit introduced a bug where cipher lists were merged using HashSet (which doesn't preserve order) instead of LinkedHashSet. Version 10.1.16, ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:461200ba-c232-5e3a-8e06-d31440b3ff70",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5a0ebc80-c2c6-56a2-a46b-1ad2fd545176",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d2d91c9-3469-5b91-93b3-96c0add72ef9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65637 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.2"
    }
  ]
}