{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1ff4eec6-2c54-5215-a7ce-994f56659b84",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13",
      "version": "9.0.46-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:76bbbc6c-732e-57d8-97ee-1a818e7185e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16 where the name parameter in host-manager/html/add was rendered without HTML escaping. The target version 9.0.46 is not affected because the upstream Apache Tomcat project fixed this vulnerability years before the 9.0.46 release. The fix uses the Escape.htmlElementContent() utility to properly escape all ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:22d33ee8-c449-5c24-9c1b-b5a56d906a87",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.46 is NOT AFFECTED by CVE-2013-4590 (XXE in XML configuration files). The vulnerability was fixed by upstream Apache in 2013 via commit 05c84ff830 (adding xmlBlockExternal mechanism to LocalResolver) and f074781590 (changing default to true). Both commits are part of the upstream 9.0.46 release that TuxCare onboarded, authored by markt@apache.org and kkolinko@apache.org. The f...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ff024f69-c018-538e-a72a-3a8759aa47ff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is not present in Tomcat 9.0.46. The vulnerable pattern (checking for `/.` and `/..` BEFORE normalization loops) was fixed in the upstream release via commit 47ecd0d0f9 (April 2016, author markt@apache.org), which refactored the original CVE fix by replacing explicit post-normalization checks with semantically equivalent trailing-slash logic. This upstream fix shipped in the 9.0.4...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:d4785abb-a83e-5b0c-9e07-64624671ef38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.46 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7d01312e-76ce-5764-b84f-4c0f4f9dfd8f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 affects Apache Tomcat versions before 9.0.0.M2. The vulnerability allows unprivileged web applications to load StatusManagerServlet, bypassing SecurityManager restrictions to read arbitrary HTTP requests and session IDs. The fix adds StatusManagerServlet to the restricted servlets list in RestrictedServlets.properties. Target version 9.0.46 already contains this fix - it was appli...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:6fe1a131-225e-57d7-b71f-d68692eeff06",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is not present in Tomcat 9.0.46. The upstream fix (commit 86b2e43609 by Mark Thomas, Aug 30 2016) was already included in the upstream release before TuxCare onboarded this version. All Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain code that calls getCredentialHandler().mutate(credentials) when a user doesn't exist, ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:714bb5c6-c7a9-5250-ae9a-d75d6ebb0b6a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.46 is not affected by CVE-2016-0763. The vulnerability affected Tomcat 9.x before 9.0.0.M3. The required SecurityManager permission check is present in the target code at ResourceLinkFactory.java:61-65, matching the vendor's fix exactly. This fix was shipped in the upstream Apache Tomcat 9.0.46 release (commit 76ebc9007567 by kkolinko@apache.org, Jan 21 2016) before TuxCare's...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:90f77a0a-d395-5743-8e45-655d6fea267e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is NOT present in Tomcat 9.0.46. The vulnerability (SecurityManager bypass via system property replacement in configuration files) was fixed by Apache in July 2016 (commit c166018201), almost 5 years before the 9.0.46 release (May 2021). The fix introduced PermissionCheck interface and enforcement in SystemPropertySource.getProperty() to validate PropertyPermission before exposing...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:cd1ee926-bec7-583a-ba32-2cb5077aa6a8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Target version 9.0.46 is NOT affected by CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager via manipulation of JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The upstream fix by Mark Thomas (markt@apache.org) was included in Apache Tomcat 9.0.0-M10 (September 2016), and version 9.0.46 (March 2021) already contains this fix. Both security checks are present: JspServlet.java ignores engineOptionsClass when SecurityManager is enabled (lines 93-96), and EmbeddedServletOptions.java ignores scratchdir when SecurityManager is enabled (lines 658-661).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:122e9ebc-7bc7-57b4-ac25-f54be916c03a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Apache Tomcat 9.0.46. The vulnerability (unauthorized access to global JNDI resources without explicit ResourceLink configuration) was fixed by upstream Apache in commit 2859ac3eae on 2016-08-22, well before the 9.0.46 release in May 2021. The complete fix is present in the target code: ResourceLinkFactory maintains a per-ClassLoader registry of allowed global resources and validates access before lookup. The fix was authored by markt@apache.org and shipped in the upstream 9.0.46 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:66d752e6-858f-534a-9f13-ebb394848060",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2016-6817 affects HTTP/2 header parsing in Tomcat 9.0.0.M1-M11 and 8.5.0-8.5.6, causing an infinite loop when headers exceed available buffer space. The target version 9.0.46 contains the upstream fix (commit 079372fc7b by Mark Thomas, Oct 2016) which adds buffer expansion logic to prevent the infinite loop. This fix was already present in upstream Tomcat 9.0.46 when TuxCare onboarded it, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b22cc735-55cb-56c2-a912-c06e7e3a0cfd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 due to improper ByteBuffer state management in Http11InputBuffer.nextRequest() that could leak data between HTTP requests on persistent connections. The vulnerability was fixed by upstream Apache Tomcat in commit 452c8094a6 (December 14, 2016) by adding byteBuffer.flip() after compact() and proper position/limit reset. This fix was already present in Apache Tomcat 9.0.46 when released and before TuxCare onboarded it in September 2025. The target repository contains the enhanced version of this fix at lines 297-306 of Http11InputBuffer.java. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:f8b44160-1195-593e-9d5d-5e93f4e16962",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.46 is not affected by CVE-2017-5647. The vulnerability affects versions 9.0.0.M1 to 9.0.0.M18, and the fix was committed to upstream Apache Tomcat on 2017-03-27 by Mark Thomas. Version 9.0.46 (released in 2021) already contains the complete upstream fix, which includes: (1) SendfileKeepAliveState enum with NONE/PIPELINED/OPEN states, (2) logic in Http11Processor.processSendfile() to detect pipelined data via available(false) check, (3) proper handling in all endpoint implementations (NioEndpoint, Nio2Endpoint, AprEndpoint) to immediately process pipelined requests instead of losing them, and (4) removal of premature processor release in AbstractProtocol. The fix commit (864aa1199a) is an ancestor of the first TuxCare commit (cd0dd638c1), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b1c135b3-df33-5922-a204-2cf8fb0d8721",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2017-5650 is NOT present in this target. The vulnerability concerns HTTP/2 GOAWAY frame handling that could cause resource exhaustion by leaving streams in a waiting state. The Apache upstream fix (commits c909f014 and 5496e193, both from March 2017) shipped with Tomcat 9.0.46 before TuxCare's involvement. The fix ensures that when a GOAWAY frame is received, all associated streams are immediately closed via receiveReset(), preventing indefinite resource consumption. All fix components are present in the target code at java/org/apache/coyote/http2/Http2UpgradeHandler.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b8e3c3d9-c411-58ee-ade9-2c5b8477cf20",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Tomcat 9.0.46. The vulnerability affects Tomcat versions 9.0.0.M1 to 9.0.0.M20, while the target is version 9.0.46. The fix was already present in the upstream Apache Tomcat 9.0.46 release before TuxCare onboarded it. Both DefaultServlet.java and WebdavServlet.java contain the required DispatcherType.ERROR checks that force error dispatches to be processed as GET requests, preventing non-GET HTTP methods (PUT, DELETE, POST) from executing on static error pages. The fix was authored by upstream (markt@apache.org) in commit 7d93527254d9e9371b342800617f20d13c8b85ad, which predates the first TuxCare commit (cd0dd638c182bb6ce0260da77f39a441ca3c8b55).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b78629b6-124d-50d1-b443-42c2aeb1c89a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 Target Tomcat 9.0.46 is not vulnerable to CVE-2017-7674. The fix that adds the Vary header to CORS responses (commit b94478d45b, BZ61101) was already present in the upstream Tomcat 9.0.46 release before TuxCare onboarded it. The vulnerable pattern (missing Vary: Origin header in CORS responses) is not present. The current implementation correctly adds the Vary header when responses vary by orig...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:3b589867-48cc-5572-9540-a0863ef15ea2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2017-7675 affects Apache Tomcat HTTP/2 implementation versions 9.0.0.M1-M21 and 8.5.0-8.5.15, allowing security constraint bypass via path parameters. The vulnerability occurs when HTTP/2 requests use setString() for URI processing, which bypasses path parameter parsing. The target (Tomcat 9.0.46) is NOT AFFECTED because the fix was already present in the upstream Apache Tomcat 9.0.46 release from May 2021. The fix (commit cf181edc9a by Mark Thomas, May 2017) changed URI processing to use setBytes(), enabling proper path parameter parsing and security checks. This fix was introduced in upstream version 9.0.0-M22 and inherited by all subsequent releases including 9.0.46 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:d2855966-8578-5d22-876b-f19e78b204ce",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 The target repository (Apache Tomcat 9.0.46) is NOT AFFECTED by CVE-2019-0221. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache in March 2019 (commit 15fcd166ea) before TuxCare began maintaining this version. The fix applies HTML entity encoding to variable values via SSIMediator.ENCODING_ENTITY, preventing script execution. The vulnerable cod...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:85372a35-5e7c-5737-a0c1-2f4005190a78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 is NOT present in Apache Tomcat 9.0.46. The vulnerability was a regression introduced in 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly ignored instead of being rejected. The fix was applied in upstream version 9.0.31 (commit 060ecc5eb8 by Mark Thomas, 2019-12-17) and is present in the target version 9.0.46. The code at java/org/apache/coyote/http11/Http11...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e8cb786e-73ee-5599-aeaf-720ce43f6e62",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Version 9.0.46 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. It contains both the initial fix (commit 9a0231683a) and a subsequent optimization (commit f258efef6c) that prevent the DoS vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e0dee06c-f1bb-53ad-ae3e-8e704a31b9a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:1eba8b93-19a4-53fe-a57c-6340ac0737b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2020-13935 is not applicable to Tomcat 9.0.46. The CVE affects versions 9.0.0.M1 to 9.0.36. Version 9.0.46 is higher than the affected range and already contains the upstream fix (commit 40fa74c7) from Apache that validates WebSocket payload length MSB. The fix was shipped in the upstream 9.0.46 release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e82a60de-cc11-5db8-a8f5-6f27754865b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 Target is Apache Tomcat 9.0.46, which is outside the CVE-2020-1935 affected range (9.0.0.M1-9.0.30 per vendor). While the target accepts bare LF as a line terminator (which the CVE-2020-1935 fix initially removed), Apache Tomcat intentionally restored this behavior via bug 65272 for compatibility, while retaining the security-critical control character validation from the CVE fix. The vendor co...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:917e29a1-ae32-5a2e-a761-d56760c2f9f5",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.46-tuxcare.13."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:c1c6bb5a-b360-5016-a5ca-79f12ac916b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. CVE-2021-30639 affects Apache Tomcat versions 10.0.3-10.0.4, 9.0.44, and 8.5.64 where the errorException field in the Request object was not reset during recycling, causing persistent error states that led to DoS. The target is Tomcat 9.0.46, which includes the upstream fix (commit 8ece47c4a9) that adds `errorException = null;` in the recycle() method at line 764 of Request.java. This fix was already present in the Apache Tomcat 9.0.46 release before TuxCare onboarded it, as confirmed by the fix commit being an ancestor of the first TuxCare setup commit. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e6e28617-b7d2-5fea-b1d9-25dd5d6b19fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 is NOT present in Apache Tomcat 9.0.46. The vulnerability, which allowed authentication using variations of valid usernames due to missing LDAP character escaping in the JNDI Realm, was fixed by upstream Apache in the 9.0.46 release. The target repository inherited this fix from the upstream release before TuxCare began maintaining the branch. The defense methods (doAttributeValu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:4df73acc-ee12-5180-8de4-23c1c6e5fbeb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:96cd9ab6-bcb8-5879-a3c2-1be196425f2a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Target version 9.0.46 is not affected by CVE-2021-41079. The vulnerability affects versions 9.0.0-M1 to 9.0.43 and was fixed in upstream 9.0.44. The target inherited the complete fix from upstream 9.0.46, which includes both defense mechanisms: (1) the idx==endOffset check preventing concurrent buffer state changes, and (2) throwing IllegalStateException when bytesRead==0 despite pendingApp>0, instead of breaking the loop. The vulnerable pattern (breaking on bytesRead==0, causing infinite loop) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:a7298108-9667-5c36-8a85-d0d839e0ab15",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-42340 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:76793519-2d7d-535d-8e7a-ca8017d110dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-43980 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:3442ee69-94f4-569f-9d98-e5620522d640",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:0d0e0539-c481-5c66-982f-6f669a5b8402",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Target Tomcat 9.0.46 is NOT affected by CVE-2022-25762. The vulnerability (concurrent WebSocket write + close causing double-pooling of socket wrappers) was fixed in upstream Tomcat 9.0.21 (May 2019) via commit c2d6278b33, well before the 9.0.46 release (June 2021). The fix uses atomic compareAndSet protection in SocketWrapperBase.close() to ensure the cleanup/release logic executes exactly once, preventing the pooled wrapper from being placed in the pool twice. This upstream fix was already present in the Tomcat 9.0.46 release that TuxCare onboarded, requiring no additional backport work.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:505b13cd-c9e0-532f-a021-5efb4134304f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-29885 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:102ad59d-cbb9-51ad-a62d-24993e5b58c7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-34305 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:4ae66e25-7fd4-5bf8-b76a-3691bd694fd3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:a3e1d775-d50b-5aff-a29f-c2da92cdf5b7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:5bc071d6-a90f-52da-b926-977a63903439",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:9017eead-d603-520b-b8ec-4c2f10421d52",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-54677 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ab15c9cf-f519-564d-8396-65b80e59a3d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:21c74543-5657-5160-82ed-963c21d6f3ca",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:9173e0f5-fe65-5dcb-9b6b-610b2d4e844c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:c276cffc-4acd-5a28-9339-652d8be28ff6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:fd31253d-bc44-55d3-a912-db105418894d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:00505021-8f19-565a-ac0b-23572ed9f98f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ca3d3179-03b9-5f3d-a287-9c98f900d290",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-29129 affects Apache Tomcat 9.0.114-9.0.115 due to a regression introduced when TLS 1.3 cipher suite configuration support was added. The vulnerable code pattern (using unordered HashSet to combine cipher lists, losing configured preference order) does not exist in version 9.0.46. This version predates the feature introduction by approximately 5 years and uses a simpler, correct implem...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:335244f5-880c-5a90-aa08-7833aa6471d3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:1b04401e-f6d8-5b00-9e2a-512eae02f3f3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:fa2ec287-7539-52e2-b8c8-b6f7ca9923b0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7d2ae886-d0dd-5e5e-83b9-dda67b47ca70",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34483 does not affect version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat. Version 9.0.46 is not vulnerable. Summary: CVE-2026-34483 does NOT affect Tomcat 9.0.46. The vulnerable component JsonAccessLogValve was introduced in version 9.0.74 (April 2023), almost 2 years after version 9.0.46 was released (May 2021). The target version predates the introduction of the vulnerable feature. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:4028e75b-5167-5d62-a17c-d991437a37e4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34486 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:2553a2a1-fe9e-5adc-986c-8ac8be115e3f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34487 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8deec0f3-7998-59ea-b0f2-3bddc5530aea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b57a3236-5338-5628-ba91-270298fe0e7a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7ed2657c-2ccc-5431-bd1e-d24a47ee63e9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:c344f580-ef6d-532e-9323-af0b0e42819d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat, and is fixed in 9.0.46-tuxcare.14."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b5c6e390-fc46-5b42-b3b3-753be40ea63f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:363b27bb-510f-5a8b-8967-0a90017874f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:f98aa327-f883-59ca-bccf-402289f044c5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat, and is fixed in 9.0.46-tuxcare.14."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:708f56d1-5aaa-5e04-9054-fde7cc7de5e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:477e27c0-d467-5310-b77f-22373c7656d9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:226d05e8-387e-5769-9414-ed209f04e8b7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:f3575c28-973f-56f3-a630-aea7d7cbf27b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:6c860125-ae61-5975-8c02-4fd56a751cb9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:29c9b7cd-863a-55c9-92b0-0056a11029c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:67d9ae80-1bbe-5b59-bfdc-e7691e22427a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:649413b6-33ab-5155-b481-8f65891ee095",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ca15c892-063e-55c7-8add-9c9ade00df12",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68525 affects version 9.0.46-tuxcare.13 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.46-tuxcare.13"
    }
  ]
}