{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3d897b9a-6968-5452-b6d7-7168e872f48e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
      "version": "9.0.39-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.39"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0dc4d9fe-67dd-5d7f-922f-f4f0df8dbecb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 affects Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16. The target version 9.0.39 is not affected because the upstream vendor (Apache Software Foundation) fixed this XSS vulnerability in 2008 and refactored the fix in 2017. The fix was already present in the upstream Tomcat 9.0.39 release that TuxCare onboarded. The vulnerable pattern (unescaped hostname output in HTML) is not presen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d3ab57b1-886a-569b-ba02-572ce8a8f5d6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.39 is not affected by CVE-2013-4590 (XML External Entity vulnerability in XML configuration file parsing). The XXE defense was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded. The target includes the complete fix: LocalResolver blocks external entity resolution for any publicId/systemId not in Servlet API whitelists by throwing FileNotFoundE...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e818ff67-0d1b-5fac-83f5-26603bc92765",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 directory traversal vulnerability is NOT present in Apache Tomcat 9.0.39. The upstream Tomcat 9.0.39 release already included a fix using the \"addedTrailingSlash\" approach, which correctly handles all directory traversal edge cases (e.g., \"/..\", \"//..\", \"/./..\", \"/a/../..\"). The vulnerable pattern where paths like \"/./..\" could bypass normalization checks and escape the web applic...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3a1e8e3a-676c-5a5c-a080-9468a9a0b433",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.39 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:509ac1d8-1779-50f3-8f4a-b439d6ddf8b2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.39 is not affected by CVE-2016-0706. The vulnerability required StatusManagerServlet to be missing from the RestrictedServlets.properties list, allowing non-privileged web applications to load it and access sensitive server data (HTTP requests, session IDs). The fix was already present in the upstream Apache Tomcat 9.0.39 release when TuxCare onboarded it. The RestrictedServle...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:229b6cbb-9570-509a-b1c8-e2c17d830a68",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.39 is not affected by CVE-2016-0762. The timing attack vulnerability was fixed by Apache upstream in commit 86b2e43609 (August 30, 2016) and shipped in Tomcat 9.0.0-M10. The target version 9.0.39, onboarded by TuxCare in September 2026, already includes this upstream fix. All four affected Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the m...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:57d35ca4-db56-50f5-8a27-fd6500909a97",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not present in Apache Tomcat 9.0.39. The vulnerability required a missing SecurityManager authorization check in ResourceLinkFactory.setGlobalContext() that would allow remote authenticated users to bypass SecurityManager restrictions. The upstream fix (adding a RuntimePermission check before allowing global context modification) was authored by Konstantin Kolinko on January 21...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e8fbe89c-79ea-5489-a928-0647b5bf65fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is NOT present in Tomcat 9.0.39. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the Digester's configuration file property replacement feature. The complete fix was committed to Apache Tomcat trunk in July 2016 by Mark Thomas (commit c166018201) and was included in the upstream 9.0.39 release (May 2020) that Tux...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:62974974-750f-5569-b90b-8b65e918d3cf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6796 is not present in Tomcat 9.0.39. The vulnerability allowed malicious web applications to bypass SecurityManager by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The upstream fix by Mark Thomas was already included in the Tomcat 9.0.39 release that TuxCare onboarded. Both security checks are present: JspServlet.java forces engineOptionsName to null when IS_SECURITY_ENABLED (lines 93-97), and EmbeddedServletOptions.java forces scratchdir to null when IS_SECURITY_ENABLED (lines 658-661).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dac326c5-b2fe-5813-91f3-954c5159f759",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6797 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, allowing web applications to access global JNDI resources without explicit ResourceLink configuration. The target version 9.0.39 is NOT vulnerable - the fix was already present in the upstream Apache Tomcat 9.0.39 release (October 2020), well after the vulnerability was patched upstream (August 2016). The fix implements a ClassLoader-based registration allowlist that validates global resource access in ResourceLinkFactory.getObjectInstance(), returning null for unauthorized requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2e277174-cbfb-5940-a9c8-1db2bf313757",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6817: Target Tomcat 9.0.39 is not affected. The vulnerability (HTTP/2 header parser infinite loop when header exceeds buffer capacity) was fixed by Apache upstream in commit 079372fc7b (2016-10-20) by Mark Thomas. This fix was already present in the Tomcat 9.0.39 release that TuxCare onboarded. The target contains the complete defensive buffer expansion logic that prevents the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4a18bd2c-2e39-53d8-9952-66e8a13afadd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-M15, where improper ByteBuffer state management in Http11InputBuffer.java's nextRequest() method allowed data from one HTTP request to leak into subsequent requests on persistent connections. The target version 9.0.39 is not affected because the upstream fix (commit 98466fdc1e6 by Mark Thomas, 2016-12-14) was already present in the release TuxCare onboarded. The fix properly resets ByteBuffer position/limit between requests by calling flip() after compact() or explicitly resetting to 0 when empty. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3f8241de-655f-5d4c-ad90-6d95cfa5b8b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Tomcat's handling of pipelined HTTP requests during sendfile operations. The vulnerability causes pipelined requests to be lost, resulting in response mismatches. The upstream Apache Tomcat fix (commit 864aa1199a by Mark Thomas, March 27, 2017) was already included in the Apache Tomcat 9.0.39 release that TuxCare onboarded. The target version has never been vulnerable to this issue.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5221f1d0-59ab-5b59-a1a3-8829e500a6c9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Target Apache Tomcat 9.0.39 is not affected by CVE-2017-5650. The vulnerability affects versions 9.0.0.M1 to 9.0.0.M18, but the fix was already present in upstream Tomcat 9.0.39 before TuxCare onboarded it. Both required patches are in place: (1) the goaway() method calls close() to terminate the connection, and (2) the close() method iterates through all HTTP/2 streams and sends CANCEL reset to release held threads. Fix commits c909f0147160 and 5496e193a89b by Mark Thomas (markt@apache.org) from 2017-03-24 are ancestors of the first TuxCare commit 8084b74433a5 (Onboard version 9.0.39), confirming this is an upstream fix that shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:17e1dfbe-fb9b-5bec-9050-bfb8aaccfec1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5664 affected Apache Tomcat 9.0.0.M1 to 9.0.0.M20. The target version 9.0.39 is well beyond the affected range. The vulnerability was fixed by Apache Tomcat in version 9.0.0.M21 (commit 7d93527254d9e9371b342800617f20d13c8b85ad on May 2, 2017). The fix, which forces error page dispatches to be processed as GET requests regardless of the original HTTP method, was already present in the upstream Apache Tomcat 9.0.39 release when TuxCare onboarded it. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a807e09f-3506-5b62-bebc-e0821b9bbaf1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 affects Tomcat versions that lack the HTTP Vary header in CORS responses, enabling cache poisoning. The target (9.0.39) is NOT AFFECTED because the upstream Apache fix (commit b94478d45b, May 2017) was already present in the 9.0.39 release. The fix adds \"Vary: Origin\" to CORS responses via ResponseUtil.addVaryFieldName() in CorsFilter.addStandardHeaders() (lines 399-403), preventi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9ae3f2e6-b617-5e26-8dc1-5568a5a7b2b9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.39 is NOT AFFECTED by CVE-2017-7675. The vulnerability affects versions 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15. The fix for Bug 61120 (which addresses this CVE) was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded. The vulnerable pattern (using setString() which ignores path parameters) is not present; the code correctly uses setBytes() to ensure path parameters are properly processed and security checks function correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:96dc0ef7-2925-5466-8a20-93aa6e6d6e24",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.39 is not affected by CVE-2019-0221. The vulnerable code pattern (unescaped output in SSI printenv command) has been removed by upstream Apache Tomcat. The fix was already present in the upstream 9.0.39 release before TuxCare onboarded it. The SSIPrintenv.java file at line 44 shows the fix: getVariableValue() is called with SSIMediator.ENCODING_ENTITY parameter, which perform...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3294823c-2677-5c4c-a71a-ed8800a9f77d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.39 is NOT affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The upstream fix by Mark Thomas (commit 060ecc5eb83, Dec 17 2019) added proper validation that rejects invalid Transfer-Encoding headers with HTTP 400. This fix was already presen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:43e4009d-9bb2-55bc-959a-9ce630f89b0e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8305d895-6a7e-5b33-a393-98cf36fe4611",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Target is Apache Tomcat 9.0.39 (tag 6989c4e936, product identity confirmed via ServerInfo.properties + repo layout). CVE-2020-13934 is a memory-exhaustion DoS: on a direct h2c (HTTP/2 cleartext, prior-knowledge) connection, Tomcat upgraded the HTTP/1.1 processor to an HTTP/2 processor WITHOUT releasing/recycling the old Http11Processor, leaking one processor per such connection until OutOfMemoryError. CVE affected range: 9.0.0.M5\u20139.0.36 (fixed 9.0.37). The upstream fix (commit 172977f04a by Mark Thomas <markt@apache.org>, \"Ensure HTTP/1.1 processor is recycled after a direct h2c connection\") IS an ancestor of HEAD, and the current code at java/org/apache/coyote/AbstractProtocol.java exactly matches the post-fix state: line 880 adds `release(processor);` before swapping to the upgrade processor, and line 893 uses `state = SocketState.CLOSED;` (exit loop \u2192 clean-up) instead of the pre-fix `return SocketState.CLOSED;`. The pre-fix vulnerable pattern is absent. Fix author is upstream Apache (apache.org), not TuxCare/CloudLinux, so verdict is not_affected (vendor-fix) with justification code_not_present, not already_fixed.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7aa5e998-9eb0-5a5d-ae83-125e84f65967",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13935 is not present in Apache Tomcat 9.0.39. The vulnerability affected versions 9.0.0.M1 through 9.0.37, and the fix was included in the upstream 9.0.37 release (July 2020). When TuxCare onboarded version 9.0.39 in October 2026, the upstream code already contained the fix that validates WebSocket payload length and rejects frames with the MSB set in 64-bit payload encodings. The fix commit (40fa74c74822711ab878079d0a69f7357926723d) by Apache developer Mark Thomas is an ancestor of HEAD and predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d45095c-145d-5778-bd95-848aecc8a033",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 affects Apache Tomcat 9.0.0.M1 to 9.0.30 due to improper HTTP header end-of-line parsing that allowed invalid headers (with bare CR or control characters) to be accepted as valid, enabling HTTP Request Smuggling. The target repository is Tomcat 9.0.39, which already contains the upstream fix from commit 8bfb0ff7f25fe7555a5eb2f7984f73546c11aa26 (authored by Mark Thomas on Jan 6, 20...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b8ecc5d3-1a25-52c9-969e-5bcae64c14e8",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.39-tuxcare.2."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:96a72b3e-46e6-57b2-adcc-a4992a88d58b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.39 is not affected by CVE-2021-30639. The vulnerability was introduced in version 9.0.44 when the errorException field was added to Request.java without proper recycling. Version 9.0.39 predates this change and does not contain the errorException field at all, making the vulnerability impossible to manifest.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6e673f35-f5c5-517f-af9e-9924c4ee4f9e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-30640 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:54f9b269-2059-54e3-997c-15fe36568eac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cf18102a-7bf1-5c90-96bf-2616604379ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-41079 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0557b527-915a-5b58-b4b0-b13c51598006",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Tomcat 9.0.39 is not affected by CVE-2021-42340. This CVE describes a memory leak introduced by the fix for bug 63362, which was first applied in version 9.0.40. The vulnerable code (UpgradeInfo/UpgradeGroupInfo classes for collecting HTTP upgrade connection metrics) does not exist in version 9.0.39, making the memory leak pattern unreachable.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a389fc01-84a0-5c3e-bf02-b72933796e6a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-43980 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2185004d-c429-582e-99d1-1ab7e80cda8b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fc030c95-98c9-5ec2-904c-5e365c38d5d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. The target (Tomcat 9.0.39) is not affected by CVE-2022-25762. The vulnerability, which allowed pooled connection objects to be placed in the pool twice when WebSocket messages were sent concurrently with connection closure (leading to data cross-contamination between connections), was fixed in upstream Tomcat through a series of commits in May 2019. These fixes were already present in the Tomcat 9.0.39 release that TuxCare onboarded. The CVE affects Tomcat 9.0.0.M1 to 9.0.20; version 9.0.39 is well beyond the affected range and contains the complete fix including: atomic close protection via compareAndSet, replacement of closed sockets with CLOSED_NIO_CHANNEL sentinel objects, ClosedChannelException checks before read/write operations, and proper async I/O completion handling in WebSocket code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e0ff8b74-8abb-5467-b362-dc55036ba384",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-29885 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f936f16-5fe3-5535-b2ef-2f0c11fdb689",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-34305 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:30e046b0-d754-59d2-b148-987cf64da362",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cfa8409c-0f42-5bc9-a67f-747220ff1c4e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:090f6fb0-e082-5249-b361-105f5441ceed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e5cfff1e-cbc1-564d-9f01-204f2bc570b1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-54677 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.39-tuxcare.3."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a3cbbfa4-abe4-5f10-af00-9309586a0e54",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:226c7f78-3eae-5a3d-8728-b0195c6ba757",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d8d53272-9420-5d58-aad4-621c7b84be7c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55754 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:eccea997-34b5-5408-a796-339aa02cdb62",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bbaba530-b1e2-5600-a4ee-41597b2b25b7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:419643f2-b04c-5939-9dad-a889793c3b9f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dede7590-7ae1-59b1-9756-cd5ad526634c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-29129 describes a regression where configured cipher preference order was not preserved in Apache Tomcat versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The bug was introduced when TLS 1.3 cipher suite configuration support was added (commit 4ee45c5571, 2026-01-06), which used a HashSet to combine cipher lists, destroying the configured order. The fix (commit 8d69b33764...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b8e2c80f-d363-504a-ba75-50a66cbdaa1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e432ea8c-a7cb-5655-a119-21835c9a28c2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:693fc67c-4e09-5c2a-8a25-598712c661d9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f8afd95e-5380-52c8-8620-898b0b4e87f5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34483 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CVE identifies incomplete escaping in `JsonAccessLogValve` (CVE:1). Tracked-tree inspection and repository-wide searches find neither that class nor its JSON wrappers, identifiable in the supplied patch:63. Raw URI/query appends remain at AbstractAccessLogValve.java:1185, 1396 and 1429. Their outputs pass through the element loop to a writer that appends a newline and writes the buffer (AbstractAccessLogValve.java:718, AccessLogValve.java:613). The other built-in access log implementations use W3C format or database statements (ExtendedAccessLogValve.java:44, JDBCAccessLogValve.java:516). The escaping changes are absent, but the affected JSON output component is also absent, leaving the CVE-specific path unreachable.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:771077f0-9b98-5807-aead-3276dc8b6e96",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34486 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3e543c5f-a513-59b4-b49a-8e5041e2537c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b6aa9af7-c6be-5c44-98d7-61bfe42a2772",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b001c45c-7bfe-5cfd-bd00-ee82d64b940b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:df0016a7-54e4-5fd0-8987-28c8ac7a7a76",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:03f2bebe-dbe9-5d52-8ff1-b5e983dd9a7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.39-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4169d746-51e6-5d3d-b70e-505ea2ed9dff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:35924d58-6504-5722-97fd-a634daba04f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9ee6af2d-b764-58ec-befc-3beba8937dae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.39-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3dae2998-6fd4-53f2-858a-bf36736da468",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7187d7e0-4562-5844-87c0-6f3d3218679b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:de26712d-f079-55a3-86d2-2bafb1bdf827",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5f59ae54-b1be-5aea-9d73-1bef78f980f9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1e7c4c64-0893-5201-a904-64419cd0c1f3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e82e3ec6-274a-5dc3-bac0-c2438cef55fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:56711966-5a39-5920-ac1e-f3ea17da4090",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:22645d29-2c79-5ae9-98ca-0064d4b38c17",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.39-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7869f523-77a0-5b5f-b5c0-1c022ff0048d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
    }
  ]
}