{
  "@id": "urn:uuid:f48aa08e-3f57-49eb-93cd-034b074906f6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 62,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T16:52:53.138657+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in the host-manager application where the hostname parameter was rendered in HTML without proper escaping. This vulnerability was fixed by Apache upstream in 2008 (commit 49c71fc59c by Mark Thomas). The target version 10.1.18 already contains this fix, which was present in the upstream release when TuxCare onboarded it in December 2025. All code paths that ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is an XSS vulnerability in the host-manager application where the hostname parameter was rendered in HTML without proper escaping. This vulnerability was fixed by Apache upstream in 2008 (commit 49c71fc59c by Mark Thomas). The target version 10.1.18 already contains this fix, which was present in the upstream release when TuxCare onboarded it in December 2025. All code paths that ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The vulnerability is not present in Tomcat 10.1.18. CVE-2014-0095 affected Tomcat 8.x before 8.0.4 (fixed March 2014 by Apache upstream). The fix explicitly handles Content-Length: 0 in AJP requests to prevent thread hangs. Between Tomcat 8.x and 10.x, Apache refactored the AJP code from AbstractAjpProcessor to AjpProcessor, carrying the fix forward. The target version 10.1.18 inherited the fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 The vulnerability is not present in Tomcat 10.1.18. CVE-2014-0095 affected Tomcat 8.x before 8.0.4 (fixed March 2014 by Apache upstream). The fix explicitly handles Content-Length: 0 in AJP requests to prevent thread hangs. Between Tomcat 8.x and 10.x, Apache refactored the AJP code from AbstractAjpProcessor to AjpProcessor, carrying the fix forward. The target version 10.1.18 inherited the fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.18 is NOT affected by CVE-2017-12615. The vulnerability existed only in Tomcat 7.x's FileDirContext architecture, which lacked path validation on file creation operations. Tomcat 10.x uses a completely different architecture (WebResource/WebResourceRoot) that has had comprehensive canonical path validation built-in since its initial design in October 2012 - five years before CVE-2017-12615 was discovered. The vulnerable FileDirContext classes (org/apache/naming/resources/FileDirContext.java and VirtualDirContext.java) do not exist in Tomcat 10.x. No CVE-2017-12615 specific fixes exist for Tomcat 8+ versions; all patches are only for the 7.0.x branch. The target was never vulnerable due to architectural differences and inherent protections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Tomcat 10.1.18 is NOT affected by CVE-2017-12615. The vulnerability existed only in Tomcat 7.x's FileDirContext architecture, which lacked path validation on file creation operations. Tomcat 10.x uses a completely different architecture (WebResource/WebResourceRoot) that has had comprehensive canonical path validation built-in since its initial design in October 2012 - five years before CVE-2017-12615 was discovered. The vulnerable FileDirContext classes (org/apache/naming/resources/FileDirContext.java and VirtualDirContext.java) do not exist in Tomcat 10.x. No CVE-2017-12615 specific fixes exist for Tomcat 8+ versions; all patches are only for the 7.0.x branch. The target was never vulnerable due to architectural differences and inherent protections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is not present in Tomcat 10.1.18. The vulnerability allowed uploading JSP files via HTTP PUT requests with paths ending in '/' because the Java File API silently drops trailing slashes. The fix (commit b7e0435d17) was authored by Apache developer Mark Thomas and was already present in the upstream release before TuxCare onboarded this version. The target contains the defensive check at DirResourceSet.java:264-268 that rejects file writes when paths end with '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is not present in Tomcat 10.1.18. The vulnerability allowed uploading JSP files via HTTP PUT requests with paths ending in '/' because the Java File API silently drops trailing slashes. The fix (commit b7e0435d17) was authored by Apache developer Mark Thomas and was already present in the upstream release before TuxCare onboarded this version. The target contains the defensive check at DirResourceSet.java:264-268 that rejects file writes when paths end with '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.18 is NOT AFFECTED by CVE-2017-5648. The vulnerability was fixed by upstream Apache Tomcat maintainer Mark Thomas in commit dfa40863421d7681fed893b4256666491887e38c (March 6, 2017), which shipped in the upstream release before TuxCare onboarded this version. All affected code locations now correctly use request.getRequest() to pass facade objects (rather than internal request objects) to application listeners, preventing untrusted applications from retaining references that could access data from other web applications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "Apache Tomcat 10.1.18 is NOT AFFECTED by CVE-2017-5648. The vulnerability was fixed by upstream Apache Tomcat maintainer Mark Thomas in commit dfa40863421d7681fed893b4256666491887e38c (March 6, 2017), which shipped in the upstream release before TuxCare onboarded this version. All affected code locations now correctly use request.getRequest() to pass facade objects (rather than internal request objects) to application listeners, preventing untrusted applications from retaining references that could access data from other web applications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 concerns a race condition in Apache Tomcat's sendfile processing where the Processor could be added to the processor cache twice when sendfile completed quickly, leading to the same Processor being reused across multiple requests and causing response mix-up. The target repository (Tomcat 10.1.18) is NOT AFFECTED because the upstream Apache fix (commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8, dated 2017-03-24, fixing bug 60918) was already present in the upstream release when TuxCare onboarded this version. The fix introduces explicit SendfileState tracking to prevent premature processor recycling. All fix elements are present in the target code: SendfileState enum usage, explicit state tracking in the keep-alive loop, processSendfile() method returning SendfileState, and correct return logic checking sendfileState == SendfileState.PENDING rather than sendfileData nullability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 concerns a race condition in Apache Tomcat's sendfile processing where the Processor could be added to the processor cache twice when sendfile completed quickly, leading to the same Processor being reused across multiple requests and causing response mix-up. The target repository (Tomcat 10.1.18) is NOT AFFECTED because the upstream Apache fix (commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8, dated 2017-03-24, fixing bug 60918) was already present in the upstream release when TuxCare onboarded this version. The fix introduces explicit SendfileState tracking to prevent premature processor recycling. All fix elements are present in the target code: SendfileState enum usage, explicit state tracking in the keep-alive loop, processSendfile() method returning SendfileState, and correct return logic checking sendfileState == SendfileState.PENDING rather than sendfileData nullability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784: Apache Tomcat 10.1.18 is NOT AFFECTED. The vulnerability (open redirect via protocol-relative URLs in DefaultServlet's directory redirect) was fixed in the upstream release by Mark Thomas (Apache maintainer) in commit efb860b3ff8 (2018-09-04). The fix was already present in Tomcat 10.1.18 when TuxCare onboarded this version. The target code contains the mitigation at DefaultServ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784: Apache Tomcat 10.1.18 is NOT AFFECTED. The vulnerability (open redirect via protocol-relative URLs in DefaultServlet's directory redirect) was fixed in the upstream release by Mark Thomas (Apache maintainer) in commit efb860b3ff8 (2018-09-04). The fix was already present in Tomcat 10.1.18 when TuxCare onboarded this version. The target code contains the mitigation at DefaultServ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:33:24.546262+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is not present in Tomcat 10.1.18. The vulnerability concerned security constraints with URL pattern \"\" (empty string) not being enforced for the context root. The upstream Apache fix (commit 723ea6a5bc by Mark Thomas, 2018-02-06) was already included in the upstream release before TuxCare onboarded version 10.1.18 (first TuxCare commit 455b1de363, 2025-12-25). The fix is present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 is not present in Tomcat 10.1.18. The vulnerability concerned security constraints with URL pattern \"\" (empty string) not being enforced for the context root. The upstream Apache fix (commit 723ea6a5bc by Mark Thomas, 2018-02-06) was already included in the upstream release before TuxCare onboarded version 10.1.18 (first TuxCare commit 455b1de363, 2025-12-25). The fix is present i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Tomcat 10.1.18 is not affected by CVE-2018-1305. The vulnerability (servlet security annotation processing at load-time allowing constraint bypass based on servlet load order) was fixed in upstream Apache Tomcat in February 2018. The fix (commit 3e54b2a6) is present in the target as part of the upstream release, which shipped years after the vulnerability was patched. The vulnerable code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 10.1.18 is not affected by CVE-2018-1305. The vulnerability (servlet security annotation processing at load-time allowing constraint bypass based on servlet load order) was fixed in upstream Apache Tomcat in February 2018. The fix (commit 3e54b2a6) is present in the target as part of the upstream release, which shipped years after the vulnerability was patched. The vulnerable code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.18 is not affected by CVE-2018-1336. The vulnerable custom Utf8Decoder.java was removed by upstream Apache Tomcat in April 2022 (commit a9ca10266b) and replaced with Java's standard CharsetDecoder. This removal was already present in the upstream Tomcat 10.1.0 release (September 2022) that TuxCare onboarded for version 10.1.18. The target uses StandardCharsets.UTF_8 decoder from Java 11+, which does not have the overflow bug that caused infinite loops with supplementary characters. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Tomcat 10.1.18 is not affected by CVE-2018-1336. The vulnerable custom Utf8Decoder.java was removed by upstream Apache Tomcat in April 2022 (commit a9ca10266b) and replaced with Java's standard CharsetDecoder. This removal was already present in the upstream Tomcat 10.1.0 release (September 2022) that TuxCare onboarded for version 10.1.18. The target uses StandardCharsets.UTF_8 decoder from Java 11+, which does not have the overflow bug that caused infinite loops with supplementary characters. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 is not present in Tomcat 10.1.18. The vulnerability affected the CORS filter's insecure defaults (allowedOrigins=\"*\", supportsCredentials=\"true\") which enabled credential-bearing cross-origin requests from any origin. The upstream fix was applied in May 2018 (commit d83a76732e) and shipped in the upstream Tomcat 10.1.18 release. All four parts of the fix are present: DEFAULT_ALLOWED_ORIGINS=\"\" (line 939), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (line 954), validation preventing supportsCredentials=true with anyOriginAllowed=true (lines 679-681), and simplified addStandardHeaders logic (lines 390-397). The CVE affected versions up to Tomcat 9.0.8, and version 10.1.18 is well beyond that range with the fix already integrated by Apache upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 is not present in Tomcat 10.1.18. The vulnerability affected the CORS filter's insecure defaults (allowedOrigins=\"*\", supportsCredentials=\"true\") which enabled credential-bearing cross-origin requests from any origin. The upstream fix was applied in May 2018 (commit d83a76732e) and shipped in the upstream Tomcat 10.1.18 release. All four parts of the fix are present: DEFAULT_ALLOWED_ORIGINS=\"\" (line 939), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (line 954), validation preventing supportsCredentials=true with anyOriginAllowed=true (lines 679-681), and simplified addStandardHeaders logic (lines 390-397). The CVE affected versions up to Tomcat 9.0.8, and version 10.1.18 is well beyond that range with the fix already integrated by Apache upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 does not affect this target. The vulnerability (missing hostname verification in WebSocket TLS client connections) was fixed by upstream Apache Tomcat in June 2018 (commit 2835bb4e030c by Mark Thomas). This fix was already present in upstream Tomcat 10.1.18 when TuxCare onboarded it (commit 455b1de363 by askorik@cloudlinux.com on Setup/10.1.18). The target code at java/org/apache/tomcat/websocket/WsWebSocketContainer.java:954-960 contains the fix: setEndpointIdentificationAlgorithm(\"HTTPS\") is called on the SSLEngine to enable hostname verification by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 does not affect this target. The vulnerability (missing hostname verification in WebSocket TLS client connections) was fixed by upstream Apache Tomcat in June 2018 (commit 2835bb4e030c by Mark Thomas). This fix was already present in upstream Tomcat 10.1.18 when TuxCare onboarded it (commit 455b1de363 by askorik@cloudlinux.com on Setup/10.1.18). The target code at java/org/apache/tomcat/websocket/WsWebSocketContainer.java:954-960 contains the fix: setEndpointIdentificationAlgorithm(\"HTTPS\") is called on the SSLEngine to enable hostname verification by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:23:27.073499+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 is NOT present in Tomcat 10.1.18. The vulnerability involved a race condition in async request handling where concurrent completion and timeout could cause response misdirection between users. Apache Tomcat fixed this in June 2018 (commit 575cbbcef2) by introducing generation tracking for async timeouts and improving connection closure tracking. Both defenses are present in the ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 is NOT present in Tomcat 10.1.18. The vulnerability involved a race condition in async request handling where concurrent completion and timeout could cause response misdirection between users. Apache Tomcat fixed this in June 2018 (commit 575cbbcef2) by introducing generation tracking for async timeouts and improving connection closure tracking. Both defenses are present in the ta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.18 is not affected by CVE-2019-0199. All three defense mechanisms (stream read timeout, stream write timeout, and overhead frame tracking) are present and active by default. The vulnerable pattern (indefinite blocking on stream I/O without timeouts or overhead limits) is not present. These fixes were introduced by Apache in upstream commits around February 2019 for Tomcat 8.5.38+ and 9.0.15+. Version 10.1.18 already contained all fixes when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "Target Tomcat 10.1.18 is not affected by CVE-2019-0199. All three defense mechanisms (stream read timeout, stream write timeout, and overhead frame tracking) are present and active by default. The vulnerable pattern (indefinite blocking on stream I/O without timeouts or overhead limits) is not present. These fixes were introduced by Apache in upstream commits around February 2019 for Tomcat 8.5.38+ and 9.0.15+. Version 10.1.18 already contained all fixes when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The vulnerability was fixed in upstream Apache Tomcat by commit 15fcd166ea (March 11, 2019) which added HTML entity encoding to variable values. This fix was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded (first TuxCare commit: 455b1de, dated after the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The vulnerability was fixed in upstream Apache Tomcat by commit 15fcd166ea (March 11, 2019) which added HTML entity encoding to variable values. This fix was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded (first TuxCare commit: 455b1de, dated after the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 affects the CGI Servlet's handling of command line arguments on Windows, allowing RCE via command injection when enableCmdLineArguments is enabled. The fix adds validation of decoded arguments against a restrictive character pattern before passing to the OS. This fix was authored by upstream Apache (Mark Thomas, markt@apache.org) and was included in Tomcat 10.1.18 before TuxCare's maintenance began. The target repository at version 10.1.18 contains the complete fix with proper validation at CGIServlet.java:753-760. Additionally, the CGI servlet is disabled by default and enableCmdLineArguments defaults to false, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 affects the CGI Servlet's handling of command line arguments on Windows, allowing RCE via command injection when enableCmdLineArguments is enabled. The fix adds validation of decoded arguments against a restrictive character pattern before passing to the OS. This fix was authored by upstream Apache (Mark Thomas, markt@apache.org) and was included in Tomcat 10.1.18 before TuxCare's maintenance began. The target repository at version 10.1.18 contains the complete fix with proper validation at CGIServlet.java:753-760. Additionally, the CGI servlet is disabled by default and enableCmdLineArguments defaults to false, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 10.1.18) is not affected by CVE-2019-10072. The fix for this HTTP/2 connection window exhaustion vulnerability was already present in the upstream Tomcat 10.1.18 release before TuxCare began maintaining this version. The fix was authored by Mark Thomas (markt@apache.org) and includes timeout handling to prevent indefinite thread blocking when the connection-level flow control window is exhausted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "The target repository (Apache Tomcat 10.1.18) is not affected by CVE-2019-10072. The fix for this HTTP/2 connection window exhaustion vulnerability was already present in the upstream Tomcat 10.1.18 release before TuxCare began maintaining this version. The fix was authored by Mark Thomas (markt@apache.org) and includes timeout handling to prevent indefinite thread blocking when the connection-level flow control window is exhausted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.18 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was deprecated on December 18, 2019 and completely removed from Tomcat 10.x on January 15, 2020 (commit 46fbf32e), BEFORE the first Tomcat 10.0.0 milestone release (February 13, 2020). All Tomcat 10.x versions, including 10.1.18, use the JVM's built-in JMX remote capability (configured via -Dcom.sun.management.jmxremote.* system properties) instead of the deprecated Tomcat-specific listener. The vulnerable code path involving mutable RMI registry creation does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "Tomcat 10.1.18 is not affected by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) was deprecated on December 18, 2019 and completely removed from Tomcat 10.x on January 15, 2020 (commit 46fbf32e), BEFORE the first Tomcat 10.0.0 milestone release (February 13, 2020). All Tomcat 10.x versions, including 10.1.18, use the JVM's built-in JMX remote capability (configured via -Dcom.sun.management.jmxremote.* system properties) instead of the deprecated Tomcat-specific listener. The vulnerable code path involving mutable RMI registry creation does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 session fixation vulnerability is NOT present in Tomcat 10.1.18. The fix was applied upstream by Apache in December 2019 (commit 1ecba14e690c) and shipped in the Tomcat 10.1.18 release (January 2024), before TuxCare onboarding. All fix characteristics are present: (1) cached authentication check delayed until after request restoration, (2) FORM_PRINCIPAL_NOTE constant removed, (3) Principal never cached in session when cache=false, (4) register() method called immediately after authentication. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 session fixation vulnerability is NOT present in Tomcat 10.1.18. The fix was applied upstream by Apache in December 2019 (commit 1ecba14e690c) and shipped in the Tomcat 10.1.18 release (January 2024), before TuxCare onboarding. All fix characteristics are present: (1) cached authentication check delayed until after request restoration, (2) FORM_PRINCIPAL_NOTE constant removed, (3) Principal never cached in session when cache=false, (4) register() method called immediately after authentication. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 affects Tomcat versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 due to a regression in Transfer-Encoding header validation. The target version (Tomcat 10.1.18) is not affected because the upstream fix (commit 3c295d913e1 by Mark Thomas on 2019-12-17) was already included in the Apache release that TuxCare onboarded. The vulnerable code pattern\u2014failure to check TokenList.p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 affects Tomcat versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 due to a regression in Transfer-Encoding header validation. The target version (Tomcat 10.1.18) is not affected because the upstream fix (commit 3c295d913e1 by Mark Thomas on 2019-12-17) was already included in the Apache release that TuxCare onboarded. The vulnerable code pattern\u2014failure to check TokenList.p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 10.1.18) is not affected by CVE-2020-11996. The vulnerability, which allows attackers to cause high CPU usage through specially crafted HTTP/2 requests with large stream ID gaps, was fixed in the upstream Apache Tomcat project before version 10.1.18 was released. The fix (commit 31cab22e6a) uses ConcurrentNavigableMap.subMap() to iterate only over existing streams rather than all possible stream IDs in the gap, preventing the CPU exhaustion attack. This fix was already present in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "The target repository (Apache Tomcat 10.1.18) is not affected by CVE-2020-11996. The vulnerability, which allows attackers to cause high CPU usage through specially crafted HTTP/2 requests with large stream ID gaps, was fixed in the upstream Apache Tomcat project before version 10.1.18 was released. The fix (commit 31cab22e6a) uses ConcurrentNavigableMap.subMap() to iterate only over existing streams rather than all possible stream IDs in the gap, preventing the CPU exhaustion attack. This fix was already present in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 is NOT present in Tomcat 10.1.18-tuxcare.9. The target contains all defense mechanisms from the upstream security patches: strict CRLF validation (rejecting standalone CR bytes), control character rejection in header values (via HttpParser.isControl()), and automatic removal of malformed headers. The fix was authored by markt@apache.org (Apache upstream) on Jan 6, 2020 and shipped...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 is NOT present in Tomcat 10.1.18-tuxcare.9. The target contains all defense mechanisms from the upstream security patches: strict CRLF validation (rejecting standalone CR bytes), control character rejection in header values (via HttpParser.isControl()), and automatic removal of malformed headers. The fix was authored by markt@apache.org (Apache upstream) on Jan 6, 2020 and shipped..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Tomcat 10.1.18. All three layers of the upstream fix were already included in the version 10.1.18 release that TuxCare onboarded: (1) AJP connector disabled by default in server.xml, (2) default binding to loopback address when enabled, and (3) mandatory secret authentication (secretRequired=true). The vulnerable pattern (AJP enabled by default without authentication, listening on all interfaces) never existed in this version. The fixes were applied to upstream Apache Tomcat in Feb 2020 (versions 9.0.31, 8.5.51, 7.0.100) and were already present when Tomcat 10.1.18 was released in Jan 2024.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Tomcat 10.1.18. All three layers of the upstream fix were already included in the version 10.1.18 release that TuxCare onboarded: (1) AJP connector disabled by default in server.xml, (2) default binding to loopback address when enabled, and (3) mandatory secret authentication (secretRequired=true). The vulnerable pattern (AJP enabled by default without authentication, listening on all interfaces) never existed in this version. The fixes were applied to upstream Apache Tomcat in Feb 2020 (versions 9.0.31, 8.5.51, 7.0.100) and were already present when Tomcat 10.1.18 was released in Jan 2024.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-9484 is NOT present in Apache Tomcat 10.1.18. The vulnerability affected versions 10.0.0-M1 to 10.0.0-M4, but the fix was already included in the upstream release 10.0.0-M5 and carried forward to 10.1.18. The target contains the complete path traversal validation fix in FileStore.java (lines 346-350) that prevents session IDs with path traversal sequences from deserializing files outside the intended storage directory. This fix was authored by Mark Thomas (Apache committer) and was already present in the upstream release when TuxCare onboarded version 10.1.18.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 is NOT present in Apache Tomcat 10.1.18. The vulnerability affected versions 10.0.0-M1 to 10.0.0-M4, but the fix was already included in the upstream release 10.0.0-M5 and carried forward to 10.1.18. The target contains the complete path traversal validation fix in FileStore.java (lines 346-350) that prevents session IDs with path traversal sequences from deserializing files outside the intended storage directory. This fix was authored by Mark Thomas (Apache committer) and was already present in the upstream release when TuxCare onboarded version 10.1.18.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9 and was fixed in 10.0.0-M10 (released November 17, 2020). The target is Tomcat 10.1.18, which is significantly newer and includes the upstream fix from commit 7f004ac4 by Mark Thomas (markt@apache.org). The fix adds ':' to the list of invalid Windows filename characters, preventing File.getCanonicalPath() from behaving unexpec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9 and was fixed in 10.0.0-M10 (released November 17, 2020). The target is Tomcat 10.1.18, which is significantly newer and includes the upstream fix from commit 7f004ac4 by Mark Thomas (markt@apache.org). The fix adds ':' to the list of invalid Windows filename characters, preventing File.getCanonicalPath() from behaving unexpec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61. The target version 10.1.18 is significantly later than the affected range. All three fix components for this vulnerability (local StringBuilder instances in HpackDecoder, ConcurrentHashMap in ConnectionSettingsBase, and proper processor recycling in AbstractProtocol) were already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The vulnerable code patterns (shared mutable state causing cross-request data leakage) are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61. The target version 10.1.18 is significantly later than the affected range. All three fix components for this vulnerability (local StringBuilder instances in HpackDecoder, ConcurrentHashMap in ConnectionSettingsBase, and proper processor recycling in AbstractProtocol) were already present in the upstream Apache Tomcat 10.1.18 release when TuxCare onboarded it. The vulnerable code patterns (shared mutable state causing cross-request data leakage) are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 addresses an incomplete fix for CVE-2020-9484 related to directory traversal validation. The vulnerability involved using string-based canonical path prefix matching (getCanonicalPath().startsWith()) which could be bypassed on some platforms. The target Apache Tomcat 10.1.18 is NOT AFFECTED because the upstream fix (commit 6d66e99ef85 by Mark Thomas, 2021-01-20) was already present in the Apache Tomcat 10.1.18 release that TuxCare onboarded. All affected code locations (FileStore.java, DefaultServlet.java, ExpandWar.java, ContextConfig.java, HostConfig.java) use the fixed pattern with java.nio.file.Path.startsWith() for robust subdirectory validation. The vulnerable string-based pattern is completely absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 addresses an incomplete fix for CVE-2020-9484 related to directory traversal validation. The vulnerability involved using string-based canonical path prefix matching (getCanonicalPath().startsWith()) which could be bypassed on some platforms. The target Apache Tomcat 10.1.18 is NOT AFFECTED because the upstream fix (commit 6d66e99ef85 by Mark Thomas, 2021-01-20) was already present in the Apache Tomcat 10.1.18 release that TuxCare onboarded. All affected code locations (FileStore.java, DefaultServlet.java, ExpandWar.java, ContextConfig.java, HostConfig.java) use the fixed pattern with java.nio.file.Path.startsWith() for robust subdirectory validation. The vulnerable string-based pattern is completely absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 is NOT present in Apache Tomcat 10.1.18. The vulnerability involves accepting malformed Content-Length headers (containing control characters or invalid syntax) when rejectIllegalHeader is false, enabling request smuggling attacks. The fix was already included in upstream Apache Tomcat 10.1.18 (commit c9fe754e5d by Mark Thomas, October 2022) before TuxCare onboarded this version. The fix enforces that malformed Content-Length headers are ALWAYS rejected with HTTP 400, regardless of the rejectIllegalHeader configuration setting. Analysis confirmed the fix code is present, properly integrated into the HTTP header parsing path (Http11InputBuffer.java lines 1031-1048), and actively enforced during request processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "CVE-2022-42252 is NOT present in Apache Tomcat 10.1.18. The vulnerability involves accepting malformed Content-Length headers (containing control characters or invalid syntax) when rejectIllegalHeader is false, enabling request smuggling attacks. The fix was already included in upstream Apache Tomcat 10.1.18 (commit c9fe754e5d by Mark Thomas, October 2022) before TuxCare onboarded this version. The fix enforces that malformed Content-Length headers are ALWAYS rejected with HTTP 400, regardless of the rejectIllegalHeader configuration setting. Analysis confirmed the fix code is present, properly integrated into the HTTP header parsing path (Http11InputBuffer.java lines 1031-1048), and actively enforced during request processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Tomcat 10.1.18) is not affected by CVE-2022-45143. The vulnerability was fixed by upstream Apache in commit 1f50bff8da (November 9, 2022) before TuxCare onboarded this version. JsonErrorReportValve.java properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing JSON injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "The target repository (Tomcat 10.1.18) is not affected by CVE-2022-45143. The vulnerability was fixed by upstream Apache in commit 1f50bff8da (November 9, 2022) before TuxCare onboarded this version. JsonErrorReportValve.java properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing JSON injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 (Apache Commons FileUpload DoS via unlimited multipart parts) is NOT present in Tomcat 10.1.18. The fix was already included in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded. The fileCountMax defense mechanism exists in FileUploadBase.java with proper integration in Request.java, and is enabled by default with safe limits (maxParameterCount=1000, maxPartCount=10). The vulnerable pattern (unbounded multipart processing) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 (Apache Commons FileUpload DoS via unlimited multipart parts) is NOT present in Tomcat 10.1.18. The fix was already included in the upstream Apache Tomcat 10.1.18 release that TuxCare onboarded. The fileCountMax defense mechanism exists in FileUploadBase.java with proper integration in Request.java, and is enabled by default with safe limits (maxParameterCount=1000, maxPartCount=10). The vulnerable pattern (unbounded multipart processing) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 10.1.18 is not affected by CVE-2023-28709. The vulnerability was an off-by-one error in parameter counting logic that allowed processing exactly one parameter beyond the configured maxParameterCount limit. The upstream fix (commit ba848da71c) was already present in the Tomcat 10.1.18 release that TuxCare onboarded. The fixed code checks parameterCount >= limit BEFORE incrementing, preventing the bypass. Author: markt@apache.org (Apache Tomcat upstream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "Target Tomcat 10.1.18 is not affected by CVE-2023-28709. The vulnerability was an off-by-one error in parameter counting logic that allowed processing exactly one parameter beyond the configured maxParameterCount limit. The upstream fix (commit ba848da71c) was already present in the Tomcat 10.1.18 release that TuxCare onboarded. The fixed code checks parameterCount >= limit BEFORE incrementing, preventing the bypass. Author: markt@apache.org (Apache Tomcat upstream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.18 is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced by bug 66512's fix, which caused AJP to skip sending SEND_HEADERS messages for responses with no HTTP headers, leading to header reuse from previous requests. The fix (bug 66591) was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded, authored by Apache's Mark Thomas (markt@apache.org). The current code uses a while loop that ensures SEND_HEADERS is always sent, even for empty header sets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "Target Apache Tomcat 10.1.18 is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced by bug 66512's fix, which caused AJP to skip sending SEND_HEADERS messages for responses with no HTTP headers, leading to header reuse from previous requests. The fix (bug 66591) was already present in the upstream Tomcat 10.1.18 release that TuxCare onboarded, authored by Apache's Mark Thomas (markt@apache.org). The current code uses a while loop that ensures SEND_HEADERS is always sent, even for empty header sets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.18. The upstream fix from commit bb4624a9f3e (by Mark Thomas, 2023-08-22) was already included in the Apache Tomcat 10.1.13+ release series. When TuxCare onboarded version 10.1.18, the fix was already present in the upstream code. The defense code at FormAuthenticator.java:765-7...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.18. The upstream fix from commit bb4624a9f3e (by Mark Thomas, 2023-08-22) was already included in the Apache Tomcat 10.1.13+ release series. When TuxCare onboarded version 10.1.18, the fix was already present in the upstream code. The defense code at FormAuthenticator.java:765-7..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Apache Tomcat 10.1.18. The vulnerability was fixed by upstream Apache developer Mark Thomas (commit 76bb4bfbfea, dated 2023-10-05) and shipped in the Tomcat 10.1.18 release BEFORE TuxCare onboarded it (2025-12-25). All three fix components are present and active by default: (1) overheadResetFactor configuration (default 50), (2) RST_STREAM frame overhead tracking in Http2UpgradeHandler.reset(), and (3) overhead limit enforcement in Http2AsyncParser that stops parsing and closes connections when the limit is exceeded. The defense prevents rapid reset attacks by penalizing each RST frame and terminating abusive connections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Apache Tomcat 10.1.18. The vulnerability was fixed by upstream Apache developer Mark Thomas (commit 76bb4bfbfea, dated 2023-10-05) and shipped in the Tomcat 10.1.18 release BEFORE TuxCare onboarded it (2025-12-25). All three fix components are present and active by default: (1) overheadResetFactor configuration (default 50), (2) RST_STREAM frame overhead tracking in Http2UpgradeHandler.reset(), and (3) overhead limit enforcement in Http2AsyncParser that stops parsing and closes connections when the limit is exceeded. The defense prevents rapid reset attacks by penalizing each RST frame and terminating abusive connections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:06:21.253116+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-45648 (HTTP trailer header parsing vulnerability) is NOT present in Tomcat 10.1.18. The target version includes the upstream fix that was released in Tomcat 10.1.14. The fix adds strict validation to reject trailer headers with non-token characters in names and control characters (except tab) in values, preventing request smuggling attacks. This fix was authored by Mark Thomas (Apache ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 (HTTP trailer header parsing vulnerability) is NOT present in Tomcat 10.1.18. The target version includes the upstream fix that was released in Tomcat 10.1.14. The fix adds strict validation to reject trailer headers with non-token characters in names and control characters (except tab) in values, preventing request smuggling attacks. This fix was authored by Mark Thomas (Apache ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Tomcat 10.1.18 repository is not affected by CVE-2023-46589. The vulnerability (improper validation of HTTP trailer headers leading to request smuggling) was fixed in upstream Apache Tomcat commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas. This fix was already included in the upstream Tomcat 10.1.18 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "The target Tomcat 10.1.18 repository is not affected by CVE-2023-46589. The vulnerability (improper validation of HTTP trailer headers leading to request smuggling) was fixed in upstream Apache Tomcat commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas. This fix was already included in the upstream Tomcat 10.1.18 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:43:00.122669+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.18 is not affected by CVE-2024-21733. The vulnerability, which allows disclosure of sensitive information through error messages when I/O should not be allowed, was fixed in the upstream Tomcat project and the fix was already present in the Tomcat 10.1.18 release. The target repository contains the complete mitigation: ErrorReportValve.java checks ActionCode.IS_IO_ALLOWED bef...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.18 is not affected by CVE-2024-21733. The vulnerability, which allows disclosure of sensitive information through error messages when I/O should not be allowed, was fixed in the upstream Tomcat project and the fix was already present in the Tomcat 10.1.18 release. The target repository contains the complete mitigation: ErrorReportValve.java checks ActionCode.IS_IO_ALLOWED bef..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:35:21.882986+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.18 is not affected by CVE-2024-52317. This version does not have the request/response object pooling and recycling feature that causes the vulnerability. Each HTTP/2 stream has dedicated Request and Response objects (declared as final fields) that are never recycled or reused across different streams. The vulnerability affects versions 10.1.27-10.1.30, where object pooling wa...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.18 is not affected by CVE-2024-52317. This version does not have the request/response object pooling and recycling feature that causes the vulnerability. Each HTTP/2 stream has dedicated Request and Response objects (declared as final fields) that are never recycled or reused across different streams. The vulnerability affects versions 10.1.27-10.1.30, where object pooling wa..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.18 is NOT affected by CVE-2025-52434. The vulnerable component (APR/Native connector, specifically AprEndpoint.java) was completely removed from Tomcat 10.1.x on August 18, 2021, more than 2 years before version 10.1.18 was released (January 5, 2024). The target version only includes NIO-based connectors (NioEndpoint, Nio2Endpoint) and does not contain any APR/Native connector code. The CVE explicitly states the vulnerability is \"when using the APR/Native connector\" which is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "impact_statement": "Tomcat 10.1.18 is NOT affected by CVE-2025-52434. The vulnerable component (APR/Native connector, specifically AprEndpoint.java) was completely removed from Tomcat 10.1.x on August 18, 2021, more than 2 years before version 10.1.18 was released (January 5, 2024). The target version only includes NIO-based connectors (NioEndpoint, Nio2Endpoint) and does not contain any APR/Native connector code. The CVE explicitly states the vulnerability is \"when using the APR/Native connector\" which is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:27:04.167384+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.18 is NOT affected by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved when TLS 1.3 specific cipher configuration was added. The bug occurred because code used HashSet (which doesn't preserve order) instead of LinkedHashSet when merging TLS 1.3 ciphers with other ciphers. However, version 10.1.18 predates the TLS 1.3 specific cipher confi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.18 is NOT affected by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved when TLS 1.3 specific cipher configuration was added. The bug occurred because code used HashSet (which doesn't preserve order) instead of LinkedHashSet when merging TLS 1.3 ciphers with other ciphers. However, version 10.1.18 predates the TLS 1.3 specific cipher confi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T21:33:00.121568+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:27:04.167384+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:04:48.533600+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:27:04.167384+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 10.1.18-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.18-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 10.1.18-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}