{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2eeaab06-82b7-5afd-8692-101b7cb78f12",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11",
      "version": "10.1.42-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.42"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:c6327617-9976-53b0-bff2-7990c4537dff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2014-0095. The vulnerability (thread hang when processing AJP requests with Content-Length: 0) was fixed in Tomcat 8.0.4 in March 2014. The target version (10.1.42, released in 2024) is 10 years newer and contains the upstream fix in AjpProcessor.java lines 610-613, which explicitly handles zero-content-length requests by setting endOfStream=true and...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9d3485d4-bdf8-55ba-a58b-721f311e4c3f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is not present in Tomcat 10.1.42-tuxcare.11. The vulnerability involved HTTP request line parsing that permitted invalid characters, enabling request smuggling attacks when used with proxies that interpreted requests differently. The fix (adding validation via HttpParser.isNotRequestTarget() and HttpParser.isHttpProtocol()) was introduced by upstream Apache Tomcat developer Mark Thomas in commit 516bda676a (Nov 2016) and shipped in the upstream Tomcat 10.1.42 release that TuxCare onboarded. The target contains the complete defense: HttpParser validates request-target characters (line 479 of Http11InputBuffer.java) and protocol version characters (line 552), rejecting control characters, non-ASCII bytes, and RFC-forbidden special characters before request processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8; >= 8.0.0RC1, < 8.0.39; >= 7.0.0, < 7.0.73; >= 6.0.0, < 6.0.48), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 8.0.0; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6; >= 8.0.0.RC1, <= 8.0.38; >= 7.0.0, <= 7.0.72; >= 6.0.0, <= 6.0.47; < 6.0.0), Snyk (>= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:8258dade-24a5-5c75-bae4-f17a82a74474",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 affects Apache Tomcat 9.0.0.M1-M18 and 8.5.0-8.5.12. The vulnerability allowed the same Processor object to be added to the processor cache twice when sendfile processing completed quickly, potentially causing response mix-up between different clients. The target (Tomcat 10.1.42) already contains the upstream fix (commit 9233d9d6a0, March 2017) authored by Mark Thomas (markt@apache.org). The fix was present in the upstream release before TuxCare onboarded this version in March 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9e421e2d-9735-5c58-bd06-2e28c81b8e84",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Tomcat 10.1.42 is not affected by CVE-2019-0199. This HTTP/2 DoS vulnerability (excessive SETTINGS frames and indefinite stream blocking) was fixed in upstream Tomcat in February 2019. All three defense mechanisms from the patches are present in the target: (1) stream-level read/write timeouts (DEFAULT_STREAM_READ_TIMEOUT/WRITE_TIMEOUT = 20000ms), (2) overhead frame ratio tracking, and (3) connection termination when overhead exceeds threshold. The vulnerable code patterns described in the CVE (indefinite blocking, no overhead limits) are not present. The fix was shipped in the upstream 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:8270698a-83bb-5c71-abff-ac52d4c382a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. The target (Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED by CVE-2020-13934. The vulnerability involves a resource leak where HTTP/1.1 processors were not released after upgrading to HTTP/2 via h2c direct connections, leading to potential OutOfMemoryError. The fix (commit c9167ae30f by Mark Thomas, dated 2020-06-26) was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded on 2026-03-11. The defensive code is present at AbstractProtocol.java:916-917, where the HTTP/1.1 processor is properly released before creating the HTTP/2 upgrade processor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56; >= 10.0.0-M1, < 10.0.0-M6; >= 9.0.0.M5, < 9.0.36; >= 8.5.1, < 8.5.56), NVD (>= 8.5.1, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M5, <= 9.0.36; >= 8.5.1, <= 8.5.56), Snyk (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M5, < 9.0.37; >= 8.5.1, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ad92336e-704c-5886-900e-652eb865f2b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2020-13943: Target Tomcat 10.1.42 is NOT AFFECTED. The vulnerability (HTTP/2 header confusion when exceeding max concurrent streams) requires the concurrent streams validation to occur BEFORE headers are fully parsed, allowing partial header state to contaminate subsequent requests. The target has the upstream fix already applied: the validation occurs in headersEnd() AFTER receivedEndOfHea...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:eedb5bc3-6e09-5cd8-a2d4-8a070567c5a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527 (HTTP/2 header value reuse between streams) is NOT present in Apache Tomcat 10.1.42-tuxcare.11. All three upstream fixes for Bug 64830 are present: (1) HpackDecoder uses local StringBuilder instances instead of a shared field (line 224, 248); (2) ConnectionSettingsBase uses ConcurrentHashMap instead of non-thread-safe maps (line 51-52); (3) AbstractProtocol calls wrapper.unRead(leftOverInput) before processor creation (line 911). These fixes were authored by Mark Thomas (markt@apache.org) and shipped in the upstream Apache Tomcat 10.1.42 release, prior to TuxCare onboarding. The vulnerable pattern (shared mutable state causing header leakage across HTTP/2 streams) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dc56ba73-892e-59f2-ba2f-a4b18ff9c879",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 affects Apache Tomcat's h2c (HTTP/2 cleartext) connection handling, causing request data from one user to leak to another user. The vulnerability stems from: (1) shared mutable state in HpackDecoder (StringBuilder field reused across method calls), (2) non-thread-safe HashMap in ConnectionSettingsBase, and (3) incorrect lifecycle management where leftover input was restored after creating the upgrade processor instead of before. All three categories of fixes are present in the target repository at version 10.1.42. These fixes were authored by upstream Apache Tomcat committer Mark Thomas (markt@apache.org) between June 2020 and January 2021, predating TuxCare's onboarding of version 10.1.42 in March 2026. The vulnerable code patterns are not present in the target because the fixes shipped in the upstream Tomcat 10.1.42 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:29d6ab43-ec72-5481-80b6-f9e2ea953b04",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42252 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Target version 10.1.42 is not affected by CVE-2022-42252. The vulnerability involves Tomcat accepting malformed Content-Length headers when rejectIllegalHeader=false, enabling request smuggling when behind a reverse proxy. The fix (forcing rejection of malformed Content-Length headers regardless of rejectIllegalHeader setting) was already present in upstream Apache Tomcat 10.1.42 via commit c9fe754e5d by Mark Thomas (markt@apache.org). This fix shipped in the upstream release that TuxCare onboarded, predating all TuxCare commits in HEAD's history. CVE states affected versions are up to 10.1.0; target version 10.1.42 is well beyond this range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:1b876b00-e3d2-5464-b474-1c8b575ed35f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2023-24998 is NOT present in Apache Tomcat 10.1.42. The vulnerability concerns unbounded processing of multipart file upload request parts leading to DoS through resource exhaustion. The fix adds a fileCountMax limit that throws FileCountLimitExceededException when exceeded. The complete fix was already present in the upstream Apache Tomcat 10.1.42 release (commit 8a2285f13a by Mark Thomas, Dec 13 2022) before TuxCare began maintaining this version. All defense components are present: FileCountLimitExceededException class, fileCountMax field in FileUploadBase, count check before processing each part (lines 457-459), Request.java configuration (line 2646), and Parameters.size() method (lines 122-124). The vulnerable pattern (unbounded part processing without count limit) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b78d5ad5-7f7e-57eb-9014-65f66af46048",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28709 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2023-28709 affects Apache Tomcat's parameter counting logic in Parameters.java. The vulnerability is an off-by-one error where parameterCount was incremented BEFORE checking the limit (using '>'), allowing exactly one parameter over the limit to be processed. The target repository (Tomcat 10.1.42-tuxcare.11) contains the upstream fix (commit ba848da71c by Mark Thomas, dated 2023-04-11) which was included in upstream Tomcat 10.1.8 and all subsequent releases. The fix checks parameterCount >= limit BEFORE incrementing. The fix was present in the upstream 10.1.42 release that TuxCare onboarded (first TuxCare commit: 39e58930c6 \"Setup 10.1.42\"). Therefore, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:426a8bc2-0e80-5feb-abdc-08578b01fe6b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34981 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.42 is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced in version 10.1.8 (bug 66591) where responses with zero HTTP headers would not send an AJP SEND_HEADERS message, causing the proxy to reuse headers from previous requests. This was fixed upstream in version 10.1.9 (commit 2214c80305 by Mark Thomas). The target version 10.1.42 is 34 versions ahead and already contains the upstream fix - the code uses a while loop structure that guarantees SEND_HEADERS is always sent, even when numHeaders == 0. The fix was present in the upstream release when TuxCare onboarded version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:60ef80e1-7ae0-5ccb-80c7-9e6038e7b898",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 does not affect Tomcat 10.1.42. Apache lists it only for 8.5.85-8.5.93 and 9.0.70-9.0.80, fixed in 8.5.94 and 9.0.81 by commits c99ffc30 and 43b882b8, which restore DiskFileItem.finalize(). In those versions getInputStream() opens the upload's temp file with FileInputStream, which on Windows blocks deleting the file while the application leaves the stream open, so the file is never deleted. In 10.1.42, getInputStream() uses Files.newInputStream, which opens the file with delete sharing, so the delete at the end of the request succeeds and the file is gone once the leaked stream is closed or garbage-collected. finalize() is not needed in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:59c700c9-7b24-5bae-8f47-a9c88f97d0e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-44487 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability pattern (unlimited RST_STREAM frame processing without overhead tracking) was never present in the shipped version because the upstream Apache Tomcat 10.1.42 release already included the complete fix by Mark Thomas (October 2023). All three defense components are present and active by default: (1) RST frame overhead tracking with 50x weight, (2) PRIORITY_UPDATE frame overhead tracking, and (3) early parsing termination when overhead limit exceeded. Fix commit 76bb4bfbfeae827dce896f650655bbf6e251ed49 is an ancestor of the first TuxCare onboarding commit 39e58930c6, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:2e4af9f7-a34e-51dd-97c3-f00f7f700cb8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which validates that trailer header names contain only token characters and values do not contain control characters (except HT/tab), was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b1cd4395-c929-59a7-b62d-eaed8c022f62",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.42 is not affected by CVE-2023-46589. The vulnerability involves improper validation of HTTP trailer headers in chunked transfer-encoded requests, which could lead to request smuggling. According to the CVE, versions 10.1.16 onwards contain the fix. The target version 10.1.42 already includes the upstream fix that validates trailer header names using HttpParser.isToken() and trailer header values to reject control characters. The fix was authored by Mark Thomas (Apache committer) and shipped in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:5542b020-02c2-5ba9-886f-f84c595627ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat's ErrorReportValve, which could leak sensitive information through error messages when I/O should not be allowed. The upstream fix (commit ce4f9a5e0e2 by Mark Thomas, 2021-02-24) adds a check for IS_IO_ALLOWED before flushing error data to clients. This fix is present in the target at ErrorReportValve.java:100-116 and was already included in the upstream Tom...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9a594f04-722d-50f0-a166-f8e8ee9856b2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. 10.1.42 is not vulnerable. The issue is fixed in 10.1.19, and 10.1.42 is later than 10.1.19, so this version already includes the fix.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:edcafd03-b8fb-5638-b8d8-28143a944d91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-34750 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 10.1.42 is not affected by CVE-2024-34750. The vulnerability (miscounting of active HTTP/2 streams leading to incorrect infinite timeout) was fixed by upstream Apache in version 10.1.25. Since the target is version 10.1.42, the fix was already present in the upstream release when TuxCare onboarded it. The complete fix includes: AtomicBoolean removedFromActiveCount to prevent double-decrementing, decrementAndGetActiveRemoteStreamCount() method with compareAndSet protection, and corrected increment logic in headersStart(). All components are present and properly integrated across Http2UpgradeHandler, Http2AsyncUpgradeHandler, and Stream classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:984c4ff6-f3b4-5693-b404-fb66b901ca3c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38286 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Target version 10.1.42 is not affected by CVE-2024-38286. The vulnerability pattern (unbounded accumulation of TLS handshake wrap requests leading to OutOfMemoryError) is not present because the fix was already included in the upstream Apache Tomcat 10.1.25 release, which TuxCare later onboarded as version 10.1.42. The fix adds limits and validation to prevent memory exhaustion during TLS re-keying operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cbf1a437-06b4-5a22-98e6-f00032eff406",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Apache Tomcat 10.1.42 is not affected by CVE-2024-52317. The vulnerability (incorrect HTTP/2 request/response recycling leading to cross-user contamination) was fixed in upstream release 10.1.31 by commit 146f94f8 authored by Mark Thomas (markt@apache.org). The target version 10.1.42 includes this upstream fix, which splits Stream.recycle() into replace() and recycle() methods and ad...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:58060b70-ac69-5708-bf81-8d179d606b8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31650 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 10.1.42 is NOT affected by CVE-2025-31650. The vulnerability (improper error handling for invalid HTTP/2 priority headers causing memory leaks) was fixed by upstream Apache Tomcat in March 2025 and included in the official 10.1.42 release (tagged June 2025). TuxCare onboarded version 10.1.42 in March 2026, after the upstream fix was already present. The fix adds try-catch blocks around Priority.parsePriority() calls in Http2Parser.java and Stream.java to catch IllegalArgumentException and prevent incomplete request cleanup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cc0ef680-dbbc-5a52-89d5-bba702d776f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b1835b38-75e3-5c88-8df8-1ade420b50e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-52434 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Tomcat 10.1.42 is not affected by CVE-2025-52434. The vulnerability exists in the APR/Native connector (AprEndpoint.java), which was completely removed from Tomcat 10.1.x in upstream commit 314568fa45 (August 2021) before version 10.1.42 was released. The target uses NIO/NIO2 connectors instead, which have fundamentally different socket handling and do not have the APR-specific race condition vulnerability. TuxCare backported this CVE fix to 8.5.x and 9.0.x versions that still use APR, but no 10.1.x backports exist because the vulnerable code is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ae4c8937-a738-552b-9d43-31c80e59a795",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-53506 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:29366fbd-b18b-5eb6-9e3e-e4b4e31e3350",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:93c496ba-d3b8-5f63-8dde-df8cb1ae3fda",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e9853916-a9cb-5ea6-879a-66f64af0da9e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24734 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:929d1a63-8fac-501d-a004-81809ae32baf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24880 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:71311977-43ac-5277-9aa1-58443913f7aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Tomcat 10.1.42 is NOT affected by CVE-2026-29129. The vulnerability (cipher preference order not preserved) was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added using HashSet, which doesn't preserve order. Version 10.1.42 predates this change and uses LinkedHashSet throughout the cipher handling pipeline, correctly preserving the configured cipher preference order. The ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:3fd6e079-ca8d-5fe2-94ae-eb924512bc08",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0fd6bad3-3856-5e22-abd2-57f289f6e581",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9f52dbd9-5809-573b-a8ef-b4e4789cf75f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65637 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-coyote."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.42-tuxcare.11"
    }
  ]
}