{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1269bdd3-19d2-57ea-bf87-7a36426213e8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1",
      "version": "9.0.24-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.24",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.24"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8af4b462-a96f-580a-a9be-eda8eec89cdc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability affecting Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16. The target version 9.0.24 (released August 2019) is not affected. The vulnerable code pattern (unescaped hostname rendering) is not present. The current code comprehensively escapes HTML via Escape.htmlElementContent() at all display points (lines 285, 343, 357 of HTMLHostManagerServlet.java) and URL-en...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d8e27368-12c7-5bcc-b1ce-02e40be8b885",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE in XML configuration parsing) is NOT present in Tomcat 9.0.24. The upstream Apache fix was already included in the 9.0.24 release that TuxCare onboarded. The defense blocks external entity resolution in all XML configuration files (web.xml, context.xml, *.tld, *.jspx, *.tagx, tagplugin.xml) via LocalResolver with xmlBlockExternal=true by default.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a850cd78-6e9d-5d01-aa14-b0e55056924c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Version 9.0.24 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-6qr6-x7jm-x2q6 (affected below 8.0.27), NVD (affected up to 8.0.26).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ca483b42-b059-5ead-81ff-42db8687fefd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.24 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8fc91128-e05e-5ce9-bb78-4734eeffea0e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706: Target is NOT AFFECTED. The fix (adding StatusManagerServlet to the restricted servlets list) was already present in Apache Tomcat 9.0.24 when TuxCare onboarded it. The vulnerable pattern (StatusManagerServlet missing from RestrictedServlets.properties) does not exist in this version. The upstream fix commit c8601f802d from January 2016 predates the TuxCare onboarding commit (9c7...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13c098e1-a365-519a-bc33-8d8f6a90a9dc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 9.0.24. The upstream fix (commit 86b2e436099cb48f30dad950175c5beeeb763756 by Mark Thomas) was already included in the upstream release 9.0.24 when TuxCare onboarded it. All affected Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) call getCredentialHandler().mutate(credentials) when a username is not fo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:761d9799-bb7e-5d6b-bd0a-752d098c7739",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Apache Tomcat 9.0.24. The vulnerability required unauthorized modification of the server-wide JNDI naming context via ResourceLinkFactory.setGlobalContext without a SecurityManager permission check. The fix (commit 76ebc9007567c8326217dd94844540e1e27d8468 by upstream Apache developer kkolinko@apache.org) adds the required SecurityManager.checkPermission call and ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:06db03bb-594a-597a-a53d-98d41e826df4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2016-6794. The upstream fix was already present in the 9.0.24 release, having been committed by Mark Thomas (markt@apache.org) on 2016-07-28 in commit c1660182010b4255c21c874d69c124370a67784a, long before the 9.0.24 release. The fix introduces a PermissionCheck mechanism that validates PropertyPermission before returning system properties during confi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41ad87a0-3c45-5d52-b685-9b109988560c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Tomcat 9.0.24 is NOT affected by CVE-2016-6796. The vulnerability affected versions 9.0.0.M1 to 9.0.0.M9. The upstream fix (commit f603f2f4595 by Mark Thomas, 2016-08-30) was applied between M9 and M10, nearly 3 years before 9.0.24 was released (2019-08-14). Both required SecurityManager checks are present in the target code: JspServlet.java lines 93-97 nullifies engineOptionsClass when Constants.IS_SECURITY_ENABLED is true, and EmbeddedServletOptions.java lines 658-661 nullifies scratchdir parameter. The fix shipped with the upstream 9.0.24 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:02bfcafb-800e-5cc5-9910-e0636e583f68",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-6797 is not present in Tomcat 9.0.24. The vulnerability, which allowed web applications to access any global JNDI resource without explicit ResourceLink configuration, was fixed in the upstream release by commit 2859ac3eae (August 2016). The fix adds a per-ClassLoader registry that tracks explicitly linked global resources and validates all lookup requests against this registry. This upstream fix was already present when TuxCare onboarded version 9.0.24 in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:73cbb204-bc55-5a62-9261-b2346528b719",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-6817 is NOT present in Apache Tomcat 9.0.24. The vulnerability was fixed by upstream Apache in commit 079372fc7b (2016-10-20) and was already included in the upstream 9.0.24 release when TuxCare onboarded it. The fix prevents infinite loops when processing HTTP/2 headers larger than the buffer by dynamically expanding the buffer capacity.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6216ccc9-a607-5a51-a53c-8e6a635a1bb2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15, causing cross-request information disclosure due to improper ByteBuffer state management in Http11InputBuffer.java. The target version 9.0.24 is NOT vulnerable because the upstream fix (commit 98466fdc from 2016-12-14) was already included in the Apache Tomcat 9.0.24 release when TuxCare onboarded it. The fix properly manages ByteBuffer state transitions between requests by calling flip() after compact() and resetting position/limit to 0 when empty, preventing data from one HTTP request from leaking into subsequent requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4c74d072-b078-57c4-b319-c63b6b468aab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Tomcat 9.0.24 is not affected by CVE-2017-5647. The vulnerability in pipelined request handling when sendfile is used was fixed in upstream Tomcat commit 864aa1199a (2017-03-27), which shipped in 9.0.0.M19 and all subsequent versions including 9.0.24. The vulnerable pattern (premature processor release causing lost pipelined requests) has been replaced with the tristate SendfileKeepAliveState mechanism that correctly processes pipelined data immediately when sendfile completes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2aa5586a-ac18-5ac4-9709-3f5eb9a4ec3d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Target version 9.0.24 is NOT affected by CVE-2017-5650. The CVE explicitly states affected versions as \"9.0.0.M1 to 9.0.0.M18\" (milestone releases only). Version 9.0.24 is a stable release well beyond this range. Additionally, the upstream Apache Tomcat fix was already present in version 9.0.24 when released in July 2019, over 2 years after the March 2017 fix commits. Both required fixes are present in HEAD: (1) close() method explicitly resets all streams when connection closes (line 1086-1090), and (2) goaway() method calls close() when GOAWAY frame is received (line 1591). The fix was authored by upstream Apache developer Mark Thomas (markt@apache.org) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:421bd9c8-79fb-5be1-90c3-3a971abc185a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2017-5664 is NOT present in Tomcat 9.0.24. The vulnerability concerned the DefaultServlet and WebdavServlet not forcing error page dispatches to use GET method semantics, potentially allowing destructive HTTP methods (PUT, DELETE) to modify or remove static error page files. The upstream fix (commit 7d93527254 by Mark Thomas, dated May 2, 2017) added service() method overrides that detect DispatcherType.ERROR and route all error dispatches to doGet(), blocking destructive methods. This fix shipped in the upstream 9.0.24 release before TuxCare onboarded it, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:57fcd3d4-e137-5b24-8cd6-d835b52850af",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is NOT present in target Tomcat 9.0.24. The vulnerability (missing HTTP Vary header in CORS filter responses) was fixed by upstream Apache in commit e76f746e2d7 (July 2018) by Mark Thomas, which shipped in the upstream 9.0.24 release that TuxCare onboarded. The fix adds `Vary: Origin` header via ResponseUtil.addVaryFieldName() when specific origins are configured, preventing cache...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ccad81b-9b00-5886-8c8a-273fd728c695",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 9.0.24) is not affected by CVE-2017-7675. The vulnerability, which allowed bypassing security constraints via HTTP/2 requests with path parameters, was fixed in upstream Apache Tomcat by commit cf181edc9a on 2017-05-24. This fix was already included in the 9.0.24 release that TuxCare onboarded, as evidenced by the fix commit being an ancestor of the first TuxCare commit (9c7e71d9ac - 'Onboard version 9.0.24'). The vulnerable code pattern (using setString() which bypasses path parameter processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:24789311-448d-51bf-a4af-839c5343f512",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat's SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Tomcat 9.0.24 is NOT affected because the upstream fix (commit 15fcd166ea by markt@apache.org, applied 2019-03-11) was already included in the 9.0.24 release before TuxCare onboarded it. The fix applies HTML entity encoding to variable values via SSIMediator.EN...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:de29d521-6884-5c4c-953d-bb2701a59e6c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2019-17569. This CVE describes a regression introduced by refactoring in versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99. Since version 9.0.24 predates the vulnerable refactoring (9.0.24 < 9.0.28), it does not contain the broken Transfer-Encoding validation code. The code inspection confirms that proper validation logic is present in 9.0.24.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1c8b6075-2e2a-540f-a9a6-66f809d0c487",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-11996 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e21c00e8-d5c3-5c02-a5d8-ffb2208605d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0a5867a9-674b-5866-8a56-fcd73ff0094c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13935 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:84e93625-2ecc-5f18-aa64-4b953fd2d171",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-1935 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b10ca21-9d06-5fdc-9af4-ce67ba3e3240",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.24-tuxcare.1."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e1dac3ec-302f-5541-b088-2f5478407ede",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.24 is not affected by CVE-2021-30639. This vulnerability was introduced as a regression in later versions (9.0.44, 8.5.64, 10.0.3-10.0.4) when commit 3082475acb on the 9.0.x line (0a11905b67 on 8.5.x) added an errorException field for improved non-blocking I/O error handling but failed to reset it in the recycle() method. Version 9.0.24 predates this change and does not contain the errorException field, making the vulnerability pattern impossible to manifest.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a9f4fc6b-700c-5a86-b9a8-f1e630ce1643",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-30640 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:37ba618e-d51b-5144-9ffb-63efce660176",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:25cd2eb6-aacd-50cb-828b-d10409b22864",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-41079 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:827eea57-f042-5bad-b03c-cadaae6e064a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Version 9.0.24 is not affected by CVE-2021-42340. The vulnerability was introduced by the bug 63362 fix in October 2020 (affecting versions 9.0.40+), which added the UpgradeInfo object for metrics collection. Version 9.0.24 (released August 2019) predates this change and does not contain UpgradeInfo, therefore the vulnerable pattern does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e7ce7282-f2f3-5409-a7e9-bce3788e869a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 9.0.24 is NOT AFFECTED by CVE-2021-43980. The CVE states \"The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing concurrency bug.\" Version 9.0.24 predates this architectural change (9.0.47) and uses the older ConcurrentHashMap-based processor management instead of the vulnerable currentProcessor ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9734c44-c23f-59aa-bd58-4b00291b75b3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a9672d24-e54c-5853-be38-5fccbfbee161",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. The upstream fix was released in 9.0.20, and version 9.0.24 is a later release of the same line. Advisories: GitHub GHSA-h3ch-5pp2-vh6w (fixed in 9.0.20), NVD (fixed in 9.0.21), CVE record (last affected 9.0.20).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3ebfe83d-fad9-5280-b610-76293d4dc355",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-29885 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1980231e-59db-5eed-ae6d-47d1d1cb1959",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-34305 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Version 9.0.24 is not affected by CVE-2022-34305. The vulnerable code (unfiltered display of session and principal attributes in HTML tables) was added in commit 4666a36eb6 on 2019-11-28, more than 3 months after version 9.0.24 was tagged on 2019-08-14. The file `/webapps/examples/jsp/security/protected/index.jsp` in version 9.0.24 has only 82 lines and does not contain the code that iterates o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0c8ac30b-8ec5-5c25-8f7d-4e68dff214ed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9575026-ffca-5f52-b00c-23bfdad9172c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:da57191e-aba1-524f-9441-7822062c2d65",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f98d7781-92c0-5d50-a069-295ca3882860",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-54677 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f37a7514-a13d-5579-b4e4-676942cf3990",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:db53107e-1b35-5dd6-bef3-b0e8dbae71c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e4cca9ec-80a8-50bc-bf4b-7b0c8376cef2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55754 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:950c95ad-c607-5a9f-a337-71a76df9925b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5edbbf23-32d0-59ff-afac-7ae32bde8be6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4b97171d-ece0-5e71-92da-3d88097a37f2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6afe7508-c07c-5dd7-9326-b59780ced524",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.24 is not affected by CVE-2026-29129. The vulnerability concerns cipher preference order not being preserved when merging TLS 1.3 and regular cipher suites using HashSet. This issue was introduced when TLS 1.3 cipher configuration support was added (upstream commit 4ee45c5571, affects 9.0.114+) and fixed in commit 8d69b33764 by using LinkedHashSet. Version 9.0.24 predates the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:63741418-33b6-541d-9a37-424b7647a36d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3a1986fc-b71e-51ba-85ba-ff9dd0d323b4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2fa516d4-72b6-5cf4-b5c6-d533066a77f5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:48797043-9289-59c9-b020-3a124e6bd97d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34483 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable JsonAccessLogValve component is absent. The default configuration uses AccessLogValve with a plain-text log pattern (conf/server.xml:164), and its output is written directly to a file (java/org/apache/catalina/valves/AccessLogValve.java:615). The only JSON reference in the valves implementation sets an HTTP response content type, providing no JSON access-log path (java/org/apache/catalina/valves/HealthCheckValve.java:57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ef8329f4-0a49-528e-9d34-0737a3248a61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34486 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6bd4f155-e879-5760-83b5-67c9d3c46a2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34487 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:44552a31-a293-5e08-bad9-8684505edf62",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8752bc85-2b90-52ff-bc40-121b34649092",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aae7475e-c77f-5c7e-83d8-adc203776cdc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5f9cf462-100d-5557-b8fd-564dd4506576",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:724d8cd4-60d3-579b-87a1-5d2efe0fb335",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b9bb764f-67cb-56bf-96ff-d517dba6264a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:788604e0-dd6b-50a2-bbd5-2688c2d2db1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e69e7ce1-4011-5217-9412-b5e0eb1797a9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1c23e14e-1961-5772-853d-d261887a0d4d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f10f6071-96ae-5b27-8323-0595bc8011cf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:557a283b-01a6-5f3f-9aa6-2f2b62233d4b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e8a9938d-2e80-5ec1-a052-8c6851846e15",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:77ee8777-4327-52a6-a2be-eaaa27113518",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:da71b7a9-69b6-59be-a3e0-c926341b0a36",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a376fd0e-f67e-573b-815c-ad2a7d4524a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f3bc00a4-3273-5d32-8680-360785b725e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1"
    }
  ]
}