{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1f9c0c4c-6c21-5a8b-8276-ab3a485ea63e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat",
      "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17",
      "version": "9.0.50-tuxcare.17",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat",
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.50",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2008-1947",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:ea925679-a9fc-5c6a-990f-a71aa8ba60fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Tomcat's host-manager where the name parameter was not HTML-escaped before rendering. The target (Tomcat 9.0.50) properly escapes all user inputs including the name parameter via Escape.htmlElementContent() before HTML rendering. This protection was introduced in upstream commit 17fdaef177 (October 2017) by Apache developer Mark Thomas and shipped...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:b955e491-f72b-535f-927c-de67fe12bb51",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 9.0.50-tuxcare.17 is NOT affected by CVE-2013-4590. The XXE vulnerability fix was already present in the upstream 9.0.50 release that TuxCare onboarded. The fix introduces xmlBlockExternal configuration (default: true) and modifies LocalResolver to block external entity resolution, throwing FileNotFoundException for unresolved entities. All key components are properly i...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5174",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:69b20470-738c-522a-a536-cfc28f709f7a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is NOT present in Tomcat 9.0.50-tuxcare.17. The vulnerability allowed directory traversal via edge-case path patterns (e.g., `//..`, `/./../`, `/a/../..`) that bypassed validation checks. The fix was introduced by Apache upstream commit 47ecd0d0f9 (2016-04-20, author: Mark Thomas) and shipped in the Tomcat 9.0.50 release that TuxCare onboarded. The fix uses an `addedTrailingSlash`...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:3acb6c51-db6e-524d-8558-d3fdd3cb4758",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). The upstream fix was released in 9.0.0.M2, and version 9.0.50 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0706",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:a4b1af60-148f-56ff-b697-aa05bd91f679",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is NOT present in target Apache Tomcat 9.0.50. The vulnerability required StatusManagerServlet to be missing from the RestrictedServlets.properties list, allowing non-privileged applications to load it and read arbitrary HTTP requests/session IDs. The fix (adding StatusManagerServlet=restricted to RestrictedServlets.properties) was committed by Apache upstream on 2016-01-04 in com...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:83c69af3-25a0-54f1-a4a3-b06e6e185508",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 (timing attack allowing username enumeration) is NOT present in Tomcat 9.0.50. The fix was included in the upstream Apache Tomcat release before TuxCare onboarded this version. All patched Realm implementations (RealmBase, DataSourceRealm, MemoryRealm, JDBCRealm) contain the mitigation: when a user is not found, the code now calls getCredentialHandler().mutate(credentials) to equa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:2dec025e-1696-5800-a3b8-6587deab20ca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 affects Apache Tomcat 9.x before 9.0.0.M3. The target repository is Tomcat 9.0.50, which already contains the upstream security fix. The vulnerable code pattern (missing SecurityManager authorization check in setGlobalContext) is not present because the fix was included in the upstream Apache Tomcat 9.0.50 release before TuxCare began maintaining this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:61c62406-8641-5ba2-9c49-1fbe6832ddbb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 (SecurityManager bypass via system property replacement in configuration files) is NOT present in Apache Tomcat 9.0.50. The vulnerability was fixed in the upstream Apache Tomcat project in 2016 with the introduction of PermissionCheck mechanism. The fix was already included in the Apache Tomcat 9.0.50 release (June 2021) that TuxCare onboarded, predating all TuxCare modifications ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6796",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:635f4042-dfa2-5bfd-880c-c3b5e1c3351d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2016-6796 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9 via SecurityManager bypass through manipulation of JSP Servlet configuration parameters. The target (Tomcat 9.0.50) is NOT AFFECTED because the upstream fix was already present in the Apache Tomcat 9.0.50 release before TuxCare maintenance began. Both required defenses are present: JspServlet.java nullifies engineOptionsClass and EmbeddedServletOptions.java nullifies scratchdir when SecurityManager is enabled. Fix authored by Mark Thomas (markt@apache.org) in commit f603f2f459, which is an ancestor of HEAD and predates the first TuxCare commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6797",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:2e6a6d80-50f0-57ed-9b94-f6c44cc8e4c3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Apache Tomcat 9.0.50. The vulnerability allowed web applications to access any global JNDI resource without an explicit ResourceLink configuration. The fix was already present in the upstream Apache Tomcat 9.0.50 release (commit 2859ac3eae by markt@apache.org on Aug 22, 2016), predating TuxCare's involvement. The fix implements a ClassLoader-based registry that validates global resource access, returning null when a web app attempts to access an unregistered resource. Target version 9.0.50 is far beyond the affected range (9.0.0.M1 to 9.0.0.M9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:741df105-a8f8-5af2-bed8-d2ef02e7dc2b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2016-6817 is not present in Apache Tomcat 9.0.50. The vulnerability affected versions 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6. The fix (commit 079372fc7b from October 2016) was already included in the upstream release 9.0.50 (released June 2021) when TuxCare onboarded it. The target code contains the buffer expansion logic that prevents the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:6b1428a2-ddbc-5335-a0c3-181a9992c402",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-M15 due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that allows cross-request information disclosure. The target (Tomcat 9.0.50) is not affected because the upstream fix was already present in release 9.0.50 when TuxCare onboarded it. The fix (commit 98466fdc1e6 by Mark Thomas, 2016-12-14) correctly resets ByteBuffer position/limit between requests by calling flip() after compact() and resetting to 0 when buffer is fully consumed. This prevents stale data from one request leaking into subsequent requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5647",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:b889608b-94ce-5c21-92f3-95715353bfcf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2017-5647 is NOT present in Apache Tomcat 9.0.50. The vulnerability involved loss of pipelined HTTP request data after sendfile completion, causing response-to-request mismatches. The fix was authored by upstream Apache developer Mark Thomas (markt@apache.org) in commit 864aa1199a (March 2017) and shipped in Tomcat 9.0.0-M19. This upstream fix predates TuxCare's onboarding and is fully present in the target at commit e8f9549bc7. The vulnerable pattern (boolean keepAlive flag without pipelined-data detection) has been replaced with SendfileKeepAliveState enum and immediate pipelined-request processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:f5698ffe-be93-52a8-a603-d4cc6e3f3967",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2017-5650 is NOT present in Tomcat 9.0.50. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed by Apache Tomcat upstream on March 24, 2017, over 4 years before the 9.0.50 release (June 28, 2021). The fix consists of two commits: (1) adding stream reset logic in close() method to call receiveReset() on all streams, and (2) calling close() when GOAWAY frame is received. Both fixes are present in the target at lines 1199-1205 (stream reset loop in close()) and line 1819 (close() call in goaway()). The receiveReset() method properly releases threads waiting for allocations via cancelAllocationRequests() and notifies waiting threads via inputBuffer.receiveReset(), directly addressing the CVE's concern about thread exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5664",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:d08779f3-8de2-5ed5-a007-e8d69d8c71a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.50 is not affected by CVE-2017-5664. The vulnerable pattern (DefaultServlet and WebdavServlet allowing arbitrary HTTP methods on error dispatches to static error pages) is not present in the target. The upstream fix, authored by Mark Thomas (markt@apache.org) and committed in May 2017, was already included in the Apache Tomcat release that TuxCare onboarded. Both servlets now override the service() method to intercept ERROR dispatches and force processing through doGet() regardless of the original HTTP method, preventing write operations on static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7674",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:3df930ed-7ebe-5d83-87a4-3b510dabd5be",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 is NOT present in Apache Tomcat 9.0.50. The vulnerability (missing Vary: Origin header in CORS filter responses, allowing cache poisoning) was fixed in upstream Apache Tomcat in May 2017 (commit b94478d45b by Remy Maucherat). The fix was included in the 9.0.50 release, which TuxCare onboarded in November 2025. The current code correctly adds the Vary header via ResponseUtil.addVar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:1725ebf2-98bd-510e-840a-b665f8b2f113",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2017-7675 does not affect Apache Tomcat 9.0.50-tuxcare.17. The vulnerability was fixed in upstream Apache Tomcat by commit cf181edc9a8 (Mark Thomas, 2017-05-24) before this version was released. The fix changes HTTP/2 URI processing from setString() to setBytes() to ensure path parameters are correctly parsed and security checks prevent directory traversal. The target repository contains this fix at java/org/apache/coyote/http2/Stream.java lines 364-369, including the comment referencing Bug 61120 and directory traversal prevention.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:ec932283-f9a5-588d-af49-1bd5ff0175d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat versions 9.0.0.M1 to 9.0.17. The target is version 9.0.50, which already contains the fix in the upstream release. The SSIPrintenv command uses entity encoding (SSIMediator.ENCODING_ENTITY) to escape user-provided data before output, preventing XSS. The fix was introduced by upstream commit 15fcd166ea by Mark Thomas (markt@apache.org) on March 11, 2019, well ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17569",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:9f47c5b9-23e7-55f3-8cb6-1fd9e25b35d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.50 is not affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, potentially leading to HTTP Request Smuggling. The fix was applied by Apache upstream in commit 060ecc5eb839208687b7fcc9e35287ac8eb46998 (authored Dec 17, 2019 by Mark Thomas) and was already present in the upstr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11996",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:444b7413-4cd4-5906-bda2-5aec9fb882ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11996 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. Version 9.0.50 is not vulnerable. Summary: The target repository contains a functionally equivalent fix for CVE-2020-11996. While the implementation differs from the provided patch, it addresses the same performance issue using a more efficient approach with ConcurrentNavigableMap.subMap(). [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:c904e4f6-8da6-51c8-8c2f-8de527be3b7e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:efbb2459-5d98-5b54-ac69-7d431ac61dae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2020-13935 affects Apache Tomcat versions 9.0.0.M1 to 9.0.36. The target version 9.0.50 is not affected because the upstream fix (commit 40fa74c748, authored by Mark Thomas on June 29, 2020) was already included in the upstream release. The fix adds validation to reject WebSocket frames with invalid 64-bit payload lengths (MSB set), preventing infinite loops. The validation is present in WsFrameBase.java lines 264-270 at the target HEAD (e8f9549bc7). This is an upstream fix that shipped in Tomcat 9.0.37 and all subsequent releases including 9.0.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:2b727d00-336e-5157-8edc-90337e3a6143",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1935 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 is NOT present in the target. The vulnerability affected Apache Tomcat 9.0.0.M1 to 9.0.30 due to lenient HTTP header parsing that accepted malformed CRLF sequences and control characters in header values. The fix was introduced by upstream Apache in commit 8bfb0ff7f2 (2020-01-06) and first released in version 9.0.31. The target is running version 9.0.50, which is 19 versions after...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-8022",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:4a4e578c-6738-5f7e-a515-5b18d91d8611",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.50-tuxcare.17."
      }
    },
    {
      "id": "CVE-2021-30639",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:57fcf051-b85f-5eff-8c7e-e3209ee77c42",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2021-30639 is NOT present in Apache Tomcat 9.0.50. The vulnerability involved an unreset errorException field in the Request object that caused all subsequent requests to fail after a non-blocking I/O error occurred. The upstream fix (commit 8ece47c4a9, authored by markt@apache.org) was included in Tomcat 9.0.45 and is present in the target version 9.0.50. The fix adds `errorException = null;` in the Request.recycle() method (line 764), properly clearing error state between request handling cycles and preventing the denial-of-service condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-30640",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:eaea46e2-f3e5-58d8-a2c5-6c1352ae49e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-30640 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat versions 9.0.0.M1 to 9.0.45. The target version 9.0.50 already contains the upstream vendor fix (commit c4df8d44a959a937d507d15e5b1ca35c3dbc41eb by Mark Thomas, April 13, 2021) that was shipped in Tomcat 9.0.46. The fix adds proper escaping of LDAP special characters in usernames before they are used in LDAP Distinguished Names and search filters, preventing...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-33037",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:02e4452b-13e4-5558-b436-d7e0ab75c0db",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33037 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 affects Apache Tomcat versions 9.0.0.M1 to 9.0.46. The target is version 9.0.50, which already contains all three upstream fixes in the Apache release that TuxCare onboarded. The vulnerable code patterns (ignoring T-E from HTTP/1.0 clients, honoring \"identity\" encoding, allowing chunked before other encodings) were never present in 9.0.50. The fixes were authored by upstream Apac...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-41079",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:6b0c94dc-69e0-51fa-892f-babe190d4df9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-41079 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2021-41079 affects Apache Tomcat 9.0.0-M1 to 9.0.43 with an infinite loop DoS in OpenSSL TLS packet processing. The target version 9.0.50 is AFTER the affected range and contains both upstream fixes (commits 95ceaf7b32 from Jan 2021 and d4b340fa8f from Mar 2021) that prevent the infinite loop by validating internal state during TLS unwrap operations. These fixes were authored by Apache developers (remm@apache.org, markt@apache.org) and shipped in the upstream 9.0.50 release before TuxCare onboarded it. The vulnerable pattern (silent break on bytesRead==0, allowing loop continuation) is not present; the code throws IllegalStateException instead, terminating the loop. Verdict: not_affected (upstream fix already in the shipped version).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42340",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:a5337c52-3188-5f4f-8c85-36d9c8cf5e9a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-42340 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2021-43980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:69657f6a-a2b8-523a-8d86-c9b1b9866ffd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-43980 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-23181",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:35febea8-bb88-553c-9691-5c51da49721c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-25762",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:96457131-74c8-5136-8c23-aff85768c9e9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-25762 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. CVE-2022-25762 affects Apache Tomcat versions 9.0.0.M1 to 9.0.20. The target version 9.0.50 is not affected because the vulnerability was fixed upstream in October 2019 (commit 49d37dffb4) before the 9.0.50 release. The fix refactored socket-to-processor tracking from a separate ConcurrentHashMap (which could become inconsistent during concurrent close+write operations) to storage directly in the SocketWrapper, eliminating the double-pooling race condition. The vulnerable code pattern (connections Map in ConnectionHandler) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-29885",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:5f78d1ec-26af-59ba-8ce2-9fe55f0eac47",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-29885 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2022-34305",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:9418d58f-8720-5638-889a-21e67f6be231",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-34305 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:0a63cdd6-e4ec-5f9b-8c51-e4e987ef606d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:c8d06f21-2f9b-5608-b650-6c1916a5f7fc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:c8a894c2-7a2b-5ba7-a97e-eff6325e172b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2024-54677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:c9e53089-72f3-5150-a1e4-82655b99f2d4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-54677 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:7f71a83a-e760-5fd6-8084-714013a02702",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:5e5e620a-d00a-5e09-aa3b-03e81216d679",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55752 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:225ce8be-555b-5c2c-a300-56f89d77490a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:cb41ea91-69e8-5e0b-807e-5485568eaa1e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:de18b23a-34ea-5e2e-ad67-b0451a562818",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:a2511297-bf7f-5d1f-9b98-dc29120d4990",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:ebab8995-91c0-5c7d-adb3-a203ffae90e3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2026-29129. This vulnerability affects versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The target version 9.0.50 predates the vulnerable code by 64 minor versions. The bug was introduced when TLS 1.3 cipher suite support was added (commit 4ee45c5571, January 2026), which used a HashSet that destroyed the configured cipher order. Versio...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-29145",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:69bad2fd-690a-5464-a3c9-541acaffd6f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:370ddeae-4a53-5739-80bb-1630c069c07a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:1ec5fb2e-9ec1-52c8-a65b-e82c8597f192",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:245ba721-c9fe-561c-bcb7-82b2bafab90d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:6cbc67ab-c592-5618-a20d-5a5902380cc6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34486 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:de2a360c-9dfb-5c33-b930-240cf9bee73a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34487 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:df4edb73-090a-5c9d-977e-8b8c0f79321b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:91383f36-86a6-5341-b033-783837f10c25",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:0521766e-9e44-5dc3-bd93-788cb02bd970",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:080e969d-b63c-5fea-a3ba-3dcbc9ff4d36",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-43512 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:63587afe-e85c-5166-a7b3-bebd609aa09c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:0d670de0-f640-534a-8706-8c9da491be6d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:487fd4a5-b3a8-51eb-af65-7ccd4e34a12b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat, and is fixed in 9.0.50-tuxcare.18."
      }
    },
    {
      "id": "CVE-2026-50229",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:c0a23b78-c36a-5d83-9d4c-c12301b85392",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50229 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:e1632b76-fa99-5347-8311-e3ec1f4cc940",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55276",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:1a2a2d4b-559a-5d7e-876c-21f308f19f88",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55276 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:214b5afe-7801-5474-a7c5-9e970af20c1f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:66b1f7f0-1e94-5200-9ab5-1445694a12bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:a6be4643-3a84-5f0b-8a4e-cc1b6e161307",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:b41ad524-62db-53d1-9460-4b03f96816cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:4f341ffa-764d-5763-8b34-8b51b480ea25",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
        }
      ],
      "bom-ref": "urn:uuid:de860d68-19ba-56f0-becb-7d8b5b7f1cbb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68525 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.50-tuxcare.17"
    }
  ]
}