{
  "@id": "urn:uuid:44b8bb86-e6fd-42ac-bf2c-b37a8ba772a1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 65,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T16:52:53.138657+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:53.139556+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is NOT present in Tomcat 10.1.42-tuxcare.11. The XSS vulnerability in the host-manager's /html/add endpoint was fixed by upstream Apache in 2008 (commit 49c71fc59c) and this fix was already present in the upstream release 10.1.42 when TuxCare onboarded it. The current code properly HTML-escapes the name parameter using Escape.htmlElementContent() before reflecting it in HTML outpu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is NOT present in Tomcat 10.1.42-tuxcare.11. The XSS vulnerability in the host-manager's /html/add endpoint was fixed by upstream Apache in 2008 (commit 49c71fc59c) and this fix was already present in the upstream release 10.1.42 when TuxCare onboarded it. The current code properly HTML-escapes the name parameter using Escape.htmlElementContent() before reflecting it in HTML outpu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:09:26.959129+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2014-0095. The vulnerability (thread hang when processing AJP requests with Content-Length: 0) was fixed in Tomcat 8.0.4 in March 2014. The target version (10.1.42, released in 2024) is 10 years newer and contains the upstream fix in AjpProcessor.java lines 610-613, which explicitly handles zero-content-length requests by setting endOfStream=true and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2014-0095. The vulnerability (thread hang when processing AJP requests with Content-Length: 0) was fixed in Tomcat 8.0.4 in March 2014. The target version (10.1.42, released in 2024) is 10 years newer and contains the upstream fix in AjpProcessor.java lines 610-613, which explicitly handles zero-content-length requests by setting endOfStream=true and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affects Tomcat 7.0.0-7.0.79 due to FileDirContext code that used direct File construction (`new File(base, name)`) without path validation, allowing specially-crafted requests to bypass security restrictions on Windows. Tomcat 10.1.42 uses a completely different architecture (WebResourceRoot/StandardRoot) that validates ALL file write operations via the validate() method with Windows-specific path normalization. This architectural protection was introduced in 2013-2014 (before CVE disclosure in 2017) and was present in the upstream Apache Tomcat 10.1.42 release. The vulnerable code pattern does not exist in the target. Verdict: not_affected, justification: code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affects Tomcat 7.0.0-7.0.79 due to FileDirContext code that used direct File construction (`new File(base, name)`) without path validation, allowing specially-crafted requests to bypass security restrictions on Windows. Tomcat 10.1.42 uses a completely different architecture (WebResourceRoot/StandardRoot) that validates ALL file write operations via the validate() method with Windows-specific path normalization. This architectural protection was introduced in 2013-2014 (before CVE disclosure in 2017) and was present in the upstream Apache Tomcat 10.1.42 release. The vulnerable code pattern does not exist in the target. Verdict: not_affected, justification: code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.42 is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes when readonly=false. Both defensive fixes (write-side and read-side protections against paths ending with \"/\") are present in the target and were shipped in the upstream Apache Tomcat 10.1.42 release. The fixes were authored by the upstream maintainer Mark Thomas (markt@apache.org) and integrated before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "The target Apache Tomcat 10.1.42 is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes when readonly=false. Both defensive fixes (write-side and read-side protections against paths ending with \"/\") are present in the target and were shipped in the upstream Apache Tomcat 10.1.42 release. The fixes were authored by the upstream maintainer Mark Thomas (markt@apache.org) and integrated before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability involved application listeners receiving internal Request/Response objects instead of secure facade wrappers, allowing untrusted code to access data from other web applications. The fix was already present in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() facade when calling fireRequestInitEvent() and fireRequestDestroyEvent(), preventing direct access to internal request/response state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability involved application listeners receiving internal Request/Response objects instead of secure facade wrappers, allowing untrusted code to access data from other web applications. The fix was already present in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() facade when calling fireRequestInitEvent() and fireRequestDestroyEvent(), preventing direct access to internal request/response state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 affects Apache Tomcat 9.0.0.M1-M18 and 8.5.0-8.5.12. The vulnerability allowed the same Processor object to be added to the processor cache twice when sendfile processing completed quickly, potentially causing response mix-up between different clients. The target (Tomcat 10.1.42) already contains the upstream fix (commit 9233d9d6a0, March 2017) authored by Mark Thomas (markt@apache.org). The fix was present in the upstream release before TuxCare onboarded this version in March 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 affects Apache Tomcat 9.0.0.M1-M18 and 8.5.0-8.5.12. The vulnerability allowed the same Processor object to be added to the processor cache twice when sendfile processing completed quickly, potentially causing response mix-up between different clients. The target (Tomcat 10.1.42) already contains the upstream fix (commit 9233d9d6a0, March 2017) authored by Mark Thomas (markt@apache.org). The fix was present in the upstream release before TuxCare onboarded this version in March 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 affects the DefaultServlet's directory redirect mechanism in Apache Tomcat, where specially crafted URLs could generate protocol-relative redirects to attacker-controlled domains. The fix (stripping leading slashes to prevent protocol-relative redirect interpretation) is present in the target at DefaultServlet.java lines 1501-1504. This fix was introduced by upstream Apache commi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 affects the DefaultServlet's directory redirect mechanism in Apache Tomcat, where specially crafted URLs could generate protocol-relative redirects to attacker-controlled domains. The fix (stripping leading slashes to prevent protocol-relative redirect interpretation) is present in the target at DefaultServlet.java lines 1501-1504. This fix was introduced by upstream Apache commi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:33:24.546262+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is NOT present in Apache Tomcat 10.1.42-tuxcare.11. The vulnerability involved security constraints with empty-string URL patterns (\"\") being ignored instead of matching the context root (\"/\"). The upstream fix by Mark Thomas (commit 723ea6a5bc) was already included in the Apache Tomcat 10.1.42 release that TuxCare onboarded, shipping both required defenses: (1) normalization of e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 is NOT present in Apache Tomcat 10.1.42-tuxcare.11. The vulnerability involved security constraints with empty-string URL patterns (\"\") being ignored instead of matching the context root (\"/\"). The upstream fix by Mark Thomas (commit 723ea6a5bc) was already included in the Apache Tomcat 10.1.42 release that TuxCare onboarded, shipping both required defenses: (1) normalization of e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 10.1.42 is not affected by CVE-2018-1305. The vulnerability involved lazy processing of @ServletSecurity annotations at servlet load time, which could lead to load-order-dependent security constraint application. The upstream fix by Apache Tomcat developer Mark Thomas (commit 3e54b2a6314eda, Feb 2018) moved annotation processing to application startup time, ensuring consistent constraint...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 Tomcat 10.1.42 is not affected by CVE-2018-1305. The vulnerability involved lazy processing of @ServletSecurity annotations at servlet load time, which could lead to load-order-dependent security constraint application. The upstream fix by Apache Tomcat developer Mark Thomas (commit 3e54b2a6314eda, Feb 2018) moved annotation processing to application startup time, ensuring consistent constraint..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.42 is not affected by CVE-2018-1336. The vulnerable custom Utf8Decoder.java class was completely removed from Apache Tomcat in upstream commit a9ca10266b (April 2022) before TuxCare onboarded version 10.1.42. The target now uses the JVM's built-in UTF-8 decoder, which does not have the infinite loop vulnerability. This is an upstream architectural change where the vulnerable code was eliminated entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Target version 10.1.42 is not affected by CVE-2018-1336. The vulnerable custom Utf8Decoder.java class was completely removed from Apache Tomcat in upstream commit a9ca10266b (April 2022) before TuxCare onboarded version 10.1.42. The target now uses the JVM's built-in UTF-8 decoder, which does not have the infinite loop vulnerability. This is an upstream architectural change where the vulnerable code was eliminated entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 affects the default CORS filter configuration in Apache Tomcat, which previously enabled 'supportsCredentials' for all origins ('*'), creating a security risk. The fix changes defaults to be secure: DEFAULT_ALLOWED_ORIGINS from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS from \"true\" to \"false\", and adds validation preventing the insecure combination. All three fix components are present in the target at version 10.1.42. The fix was authored by upstream Apache Tomcat (markt@apache.org) in commit d83a76732e and shipped in the upstream release before TuxCare onboarded this version. Verdict: not_affected (upstream fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 affects the default CORS filter configuration in Apache Tomcat, which previously enabled 'supportsCredentials' for all origins ('*'), creating a security risk. The fix changes defaults to be secure: DEFAULT_ALLOWED_ORIGINS from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS from \"true\" to \"false\", and adds validation preventing the insecure combination. All three fix components are present in the target at version 10.1.42. The fix was authored by upstream Apache Tomcat (markt@apache.org) in commit d83a76732e and shipped in the upstream release before TuxCare onboarded this version. Verdict: not_affected (upstream fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 is NOT present in Tomcat 10.1.42. The vulnerability concerned missing hostname verification when establishing TLS WebSocket client connections (wss://), allowing man-in-the-middle attacks via certificate mismatch. The fix (enabling SSLEngine endpoint identification algorithm \"HTTPS\") was authored by Apache Tomcat maintainer Mark Thomas (commit 2835bb4e030c) on 2018-06-18 and shipped in the upstream Tomcat 10.1.42 release. The target code at WsWebSocketContainer.java:952-958 unconditionally applies hostname verification for all TLS WebSocket connections. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 is NOT present in Tomcat 10.1.42. The vulnerability concerned missing hostname verification when establishing TLS WebSocket client connections (wss://), allowing man-in-the-middle attacks via certificate mismatch. The fix (enabling SSLEngine endpoint identification algorithm \"HTTPS\") was authored by Apache Tomcat maintainer Mark Thomas (commit 2835bb4e030c) on 2018-06-18 and shipped in the upstream Tomcat 10.1.42 release. The target code at WsWebSocketContainer.java:952-958 unconditionally applies hostname verification for all TLS WebSocket connections. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:22:34.338050+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 is NOT present in Apache Tomcat 10.1.42. The vulnerability involved a race condition where async timeout events could be processed against a different async cycle than the one they were scheduled for, potentially causing response data from one user to be delivered to another user. The upstream vendor (Apache Tomcat) fixed this in commit 575cbbcef2 by implementing generation tracki...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 is NOT present in Apache Tomcat 10.1.42. The vulnerability involved a race condition where async timeout events could be processed against a different async cycle than the one they were scheduled for, potentially causing response data from one user to be delivered to another user. The upstream vendor (Apache Tomcat) fixed this in commit 575cbbcef2 by implementing generation tracki..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.42 is not affected by CVE-2019-0199. This HTTP/2 DoS vulnerability (excessive SETTINGS frames and indefinite stream blocking) was fixed in upstream Tomcat in February 2019. All three defense mechanisms from the patches are present in the target: (1) stream-level read/write timeouts (DEFAULT_STREAM_READ_TIMEOUT/WRITE_TIMEOUT = 20000ms), (2) overhead frame ratio tracking, and (3) connection termination when overhead exceeds threshold. The vulnerable code patterns described in the CVE (indefinite blocking, no overhead limits) are not present. The fix was shipped in the upstream 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "Tomcat 10.1.42 is not affected by CVE-2019-0199. This HTTP/2 DoS vulnerability (excessive SETTINGS frames and indefinite stream blocking) was fixed in upstream Tomcat in February 2019. All three defense mechanisms from the patches are present in the target: (1) stream-level read/write timeouts (DEFAULT_STREAM_READ_TIMEOUT/WRITE_TIMEOUT = 20000ms), (2) overhead frame ratio tracking, and (3) connection termination when overhead exceeds threshold. The vulnerable code patterns described in the CVE (indefinite blocking, no overhead limits) are not present. The fix was shipped in the upstream 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 (SSI printenv XSS) is not present in Tomcat 10.1.42. The fix (commit 15fcd166ea by Mark Thomas) was already included in the upstream Apache Tomcat 10.1.42 release before TuxCare onboarded this version. The vulnerable pattern (unencoded variable output) is absent because SSIPrintenv.java:41 uses `getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)`, which applies HTML entit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 (SSI printenv XSS) is not present in Tomcat 10.1.42. The fix (commit 15fcd166ea by Mark Thomas) was already included in the upstream Apache Tomcat 10.1.42 release before TuxCare onboarded this version. The vulnerable pattern (unencoded variable output) is absent because SSIPrintenv.java:41 uses `getVariableValue(variableName, SSIMediator.ENCODING_ENTITY)`, which applies HTML entit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 is NOT present in Tomcat 10.1.42. The vulnerability affected Tomcat 9.0.0.M1-9.0.17, 8.5.0-8.5.39, and 7.0.0-7.0.93, involving Windows-specific command injection via CGI servlet command-line arguments. The upstream fix (commit 4b244d827a by Mark Thomas, Apache) was included in Tomcat 9.0.18 and all subsequent releases. The target version 10.1.42 already contains the complete fix: Windows-specific pattern validation ([\\w\\Q-.\\\\/:\\E]+) that blocks shell metacharacters (&lt;, &gt;, |, \", ', spaces) from decoded command-line arguments when enableCmdLineArguments is true. This is an upstream fix that shipped with the Tomcat 10.1.42 release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 is NOT present in Tomcat 10.1.42. The vulnerability affected Tomcat 9.0.0.M1-9.0.17, 8.5.0-8.5.39, and 7.0.0-7.0.93, involving Windows-specific command injection via CGI servlet command-line arguments. The upstream fix (commit 4b244d827a by Mark Thomas, Apache) was included in Tomcat 9.0.18 and all subsequent releases. The target version 10.1.42 already contains the complete fix: Windows-specific pattern validation ([\\w\\Q-.\\\\/:\\E]+) that blocks shell metacharacters (&lt;, &gt;, |, \", ', spaces) from decoded command-line arguments when enableCmdLineArguments is true. This is an upstream fix that shipped with the Tomcat 10.1.42 release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.42-tuxcare.11 is not affected by CVE-2019-10072. The vulnerability (indefinite thread blocking during HTTP/2 connection window exhaustion) was fixed in upstream Apache Tomcat prior to version 10.1.42. The fix, authored by markt@apache.org on 2019-06-03, introduced the WindowAllocationManager abstraction with timeout-based waiting mechanisms. The target contains this upstream fix: when connection window is exhausted, threads wait with a configured timeout rather than indefinitely, and are properly notified when connections close. This is not a TuxCare backport; the fix shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "Target version 10.1.42-tuxcare.11 is not affected by CVE-2019-10072. The vulnerability (indefinite thread blocking during HTTP/2 connection window exhaustion) was fixed in upstream Apache Tomcat prior to version 10.1.42. The fix, authored by markt@apache.org on 2019-06-03, introduced the WindowAllocationManager abstraction with timeout-based waiting mechanisms. The target contains this upstream fix: when connection window is exhausted, threads wait with a configured timeout rather than indefinitely, and are properly notified when connections close. This is not a TuxCare backport; the fix shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 affects the JmxRemoteLifecycleListener feature in Tomcat 7.x, 8.5.x, and 9.0.x, allowing local attackers to manipulate the RMI registry for MITM attacks. However, Tomcat 10.1.42 is not affected because the JmxRemoteLifecycleListener feature was completely removed from the Tomcat 10.x codebase in January 2020 (commit 46fbf32e55), before the 10.1.x line was first released in September 2022. The vulnerable code does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 affects the JmxRemoteLifecycleListener feature in Tomcat 7.x, 8.5.x, and 9.0.x, allowing local attackers to manipulate the RMI registry for MITM attacks. However, Tomcat 10.1.42 is not affected because the JmxRemoteLifecycleListener feature was completely removed from the Tomcat 10.x codebase in January 2020 (commit 46fbf32e55), before the 10.1.x line was first released in September 2022. The vulnerable code does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 affects Tomcat versions up to 9.0.29, 8.5.49, and 7.0.98. The target version 10.1.42 is not affected because the vulnerability pattern was removed by an upstream fix (commit 1ecba14e69) that shipped in the Apache Tomcat release before TuxCare onboarded version 10.1.42. The fix ensures that when principal caching is disabled (cache=false), authenticated principals are never stored in the session object, eliminating the session fixation window. All fix elements are present in the target code: AuthenticatorBase only caches principals when cache=true (line 1105-1108), FormAuthenticator stores username/password in session notes when cache is false (lines 392-405), and the deprecated FORM_PRINCIPAL_NOTE constant is not used anywhere.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 affects Tomcat versions up to 9.0.29, 8.5.49, and 7.0.98. The target version 10.1.42 is not affected because the vulnerability pattern was removed by an upstream fix (commit 1ecba14e69) that shipped in the Apache Tomcat release before TuxCare onboarded version 10.1.42. The fix ensures that when principal caching is disabled (cache=false), authenticated principals are never stored in the session object, eliminating the session fixation window. All fix elements are present in the target code: AuthenticatorBase only caches principals when cache=true (line 1105-1108), FormAuthenticator stores username/password in session notes when cache is false (lines 392-405), and the deprecated FORM_PRINCIPAL_NOTE constant is not used anywhere.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:25:43.115991+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 where a regression caused invalid Transfer-Encoding headers to be processed instead of rejected, enabling HTTP Request Smuggling. The target version 10.1.42 is not affected because the upstream fix (commit 3c295d913e1, Dec 2019) was included in Tomcat 10.1.0 and all later releases. The vulnerable code ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 affects Apache Tomcat versions 9.0.28-9.0.30, 8.5.48-8.5.50, and 7.0.98-7.0.99 where a regression caused invalid Transfer-Encoding headers to be processed instead of rejected, enabling HTTP Request Smuggling. The target version 10.1.42 is not affected because the upstream fix (commit 3c295d913e1, Dec 2019) was included in Tomcat 10.1.0 and all later releases. The vulnerable code ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-11996 is NOT present in Tomcat 10.1.42. The vulnerability affected Tomcat 10.0.0-M1 to 10.0.0-M5 (and 9.0.x/8.5.x series) due to a performance issue in the closeIdleStreams() method that used numeric-range iteration. When an attacker sent HTTP/2 requests with very large stream IDs (e.g., Integer.MAX_VALUE - 8), the server would iterate billions of times, causing CPU exhaustion. The fix replaced numeric-range iteration with iteration over the actual streams collection. This fix was committed upstream by Mark Thomas (markt@apache.org) on 2020-05-22 and shipped in Tomcat 10.0.0-M6. The Tomcat 10.1.x series, first released in June 2021, inherited this fix. The target (10.1.42) uses pruneClosedStreams() with safe iteration over streams.values(), not the vulnerable closeIdleStreams() pattern. The fix was already in the upstream release when TuxCare onboarded version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 is NOT present in Tomcat 10.1.42. The vulnerability affected Tomcat 10.0.0-M1 to 10.0.0-M5 (and 9.0.x/8.5.x series) due to a performance issue in the closeIdleStreams() method that used numeric-range iteration. When an attacker sent HTTP/2 requests with very large stream IDs (e.g., Integer.MAX_VALUE - 8), the server would iterate billions of times, causing CPU exhaustion. The fix replaced numeric-range iteration with iteration over the actual streams collection. This fix was committed upstream by Mark Thomas (markt@apache.org) on 2020-05-22 and shipped in Tomcat 10.0.0-M6. The Tomcat 10.1.x series, first released in June 2021, inherited this fix. The target (10.1.42) uses pruneClosedStreams() with safe iteration over streams.values(), not the vulnerable closeIdleStreams() pattern. The fix was already in the upstream release when TuxCare onboarded version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0.M1, < 9.0.35; >= 8.5.0, < 8.5.55), NVD (>= 8.5.0, <= 8.5.55; >= 9.0.0, <= 9.0.35; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5), cve.org (>= 10.0.0-M1, <= 10.0.0-M5; >= 9.0.0.M1, <= 9.0.35; >= 8.5.0, <= 8.5.55), Snyk (>= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6; >= 8.5.0, < 8.5.56; >= 9.0.0.M1, < 9.0.36; >= 10.0.0-M1, < 10.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED by CVE-2020-1935. The vulnerability, which involved improper HTTP header parsing that allowed malformed CRLF sequences and control characters in header values (potentially enabling HTTP request smuggling), was fixed by upstream Apache Tomcat in commit ae8c82eff96990878e79691819ae941538ee62fd on January 6, 2020. This fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT AFFECTED by CVE-2020-1935. The vulnerability, which involved improper HTTP header parsing that allowed malformed CRLF sequences and control characters in header values (potentially enabling HTTP request smuggling), was fixed by upstream Apache Tomcat in commit ae8c82eff96990878e79691819ae941538ee62fd on January 6, 2020. This fix wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.42 is NOT affected by CVE-2020-1938 (Ghostcat). The vulnerability was fixed by the upstream Apache Tomcat project in early 2020 (versions 9.0.31, 8.5.51, 7.0.100), and all four key defenses are present in the 10.1.42 release: (1) AJP listens on loopback only by default, (2) request attributes are validated against an allowlist pattern (deny-by-default), (3) secret authentication support, and (4) AJP Connector is disabled (commented out) in the default server.xml. The fixes were authored by Mark Thomas (markt@apache.org) and shipped in the upstream 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "Apache Tomcat 10.1.42 is NOT affected by CVE-2020-1938 (Ghostcat). The vulnerability was fixed by the upstream Apache Tomcat project in early 2020 (versions 9.0.31, 8.5.51, 7.0.100), and all four key defenses are present in the 10.1.42 release: (1) AJP listens on loopback only by default, (2) request attributes are validated against an allowlist pattern (deny-by-default), (3) secret authentication support, and (4) AJP Connector is disabled (commented out) in the default server.xml. The fixes were authored by Mark Thomas (markt@apache.org) and shipped in the upstream 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-9484 affects Apache Tomcat versions 10.0.0-M1 to M4 (and earlier 9.x, 8.5.x, 7.x versions). The vulnerability allows remote code execution via deserialization when an attacker can control a session ID to reference files outside the FileStore storage directory. Version 10.1.42 is NOT affected because the upstream fix (commit bb33048e, dated May 5, 2020) that adds path validation to FileStore.file() was already present in the release before TuxCare's first commit. The fix validates that canonicalized file paths remain within the storage directory boundary, blocking path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 affects Apache Tomcat versions 10.0.0-M1 to M4 (and earlier 9.x, 8.5.x, 7.x versions). The vulnerability allows remote code execution via deserialization when an attacker can control a session ID to reference files outside the FileStore storage directory. Version 10.1.42 is NOT affected because the upstream fix (commit bb33048e, dated May 5, 2020) that adds path validation to FileStore.file() was already present in the release before TuxCare's first commit. The fix validates that canonicalized file paths remain within the storage directory boundary, blocking path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 affects Tomcat 10.0.0-M1 to 10.0.0-M9. The target is Tomcat 10.1.42, which is well beyond the affected version range. The security fix (adding colon character validation and case-insensitive path comparison) was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it. The fix is confirmed present at lines 185 and 153-158 of AbstractFileResourceSet....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 affects Tomcat 10.0.0-M1 to 10.0.0-M9. The target is Tomcat 10.1.42, which is well beyond the affected version range. The security fix (adding colon character validation and case-insensitive path comparison) was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it. The fix is confirmed present at lines 185 and 153-158 of AbstractFileResourceSet...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 affects Apache Tomcat's h2c (HTTP/2 cleartext) connection handling, causing request data from one user to leak to another user. The vulnerability stems from: (1) shared mutable state in HpackDecoder (StringBuilder field reused across method calls), (2) non-thread-safe HashMap in ConnectionSettingsBase, and (3) incorrect lifecycle management where leftover input was restored after creating the upgrade processor instead of before. All three categories of fixes are present in the target repository at version 10.1.42. These fixes were authored by upstream Apache Tomcat committer Mark Thomas (markt@apache.org) between June 2020 and January 2021, predating TuxCare's onboarding of version 10.1.42 in March 2026. The vulnerable code patterns are not present in the target because the fixes shipped in the upstream Tomcat 10.1.42 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 affects Apache Tomcat's h2c (HTTP/2 cleartext) connection handling, causing request data from one user to leak to another user. The vulnerability stems from: (1) shared mutable state in HpackDecoder (StringBuilder field reused across method calls), (2) non-thread-safe HashMap in ConnectionSettingsBase, and (3) incorrect lifecycle management where leftover input was restored after creating the upgrade processor instead of before. All three categories of fixes are present in the target repository at version 10.1.42. These fixes were authored by upstream Apache Tomcat committer Mark Thomas (markt@apache.org) between June 2020 and January 2021, predating TuxCare's onboarding of version 10.1.42 in March 2026. The vulnerable code patterns are not present in the target because the fixes shipped in the upstream Tomcat 10.1.42 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 fix was shipped in upstream Tomcat 10.1.42 release. All five affected path validation locations (DefaultServlet, FileStore, ContextConfig, ExpandWar, HostConfig) use the secure Path-based containment checking introduced by Mark Thomas in commit 6d66e99e (Jan 2021), replacing vulnerable string prefix comparison. The fix predates TuxCare's onboarding of version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "CVE-2021-25329 fix was shipped in upstream Tomcat 10.1.42 release. All five affected path validation locations (DefaultServlet, FileStore, ContextConfig, ExpandWar, HostConfig) use the secure Path-based containment checking introduced by Mark Thomas in commit 6d66e99e (Jan 2021), replacing vulnerable string prefix comparison. The fix predates TuxCare's onboarding of version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.42 is not affected by CVE-2022-42252. The vulnerability involves Tomcat accepting malformed Content-Length headers when rejectIllegalHeader=false, enabling request smuggling when behind a reverse proxy. The fix (forcing rejection of malformed Content-Length headers regardless of rejectIllegalHeader setting) was already present in upstream Apache Tomcat 10.1.42 via commit c9fe754e5d by Mark Thomas (markt@apache.org). This fix shipped in the upstream release that TuxCare onboarded, predating all TuxCare commits in HEAD's history. CVE states affected versions are up to 10.1.0; target version 10.1.42 is well beyond this range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "Target version 10.1.42 is not affected by CVE-2022-42252. The vulnerability involves Tomcat accepting malformed Content-Length headers when rejectIllegalHeader=false, enabling request smuggling when behind a reverse proxy. The fix (forcing rejection of malformed Content-Length headers regardless of rejectIllegalHeader setting) was already present in upstream Apache Tomcat 10.1.42 via commit c9fe754e5d by Mark Thomas (markt@apache.org). This fix shipped in the upstream release that TuxCare onboarded, predating all TuxCare commits in HEAD's history. CVE states affected versions are up to 10.1.0; target version 10.1.42 is well beyond this range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.42-tuxcare.11 is NOT affected by CVE-2022-45143. The vulnerability (JSON injection via unescaped type/message/description fields in JsonErrorReportValve) was fixed in upstream commit 1f50bff8 by Mark Thomas on 2022-11-09, which was already present in the upstream 10.1.42 release when TuxCare onboarded it on 2026-03-11. The fix uses JSONFilter.escape() to properly escape control characters, quotes, and backslashes in all user-controlled strings before embedding them in JSON output. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "The target Apache Tomcat 10.1.42-tuxcare.11 is NOT affected by CVE-2022-45143. The vulnerability (JSON injection via unescaped type/message/description fields in JsonErrorReportValve) was fixed in upstream commit 1f50bff8 by Mark Thomas on 2022-11-09, which was already present in the upstream 10.1.42 release when TuxCare onboarded it on 2026-03-11. The fix uses JSONFilter.escape() to properly escape control characters, quotes, and backslashes in all user-controlled strings before embedding them in JSON output. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 is NOT present in Apache Tomcat 10.1.42. The vulnerability concerns unbounded processing of multipart file upload request parts leading to DoS through resource exhaustion. The fix adds a fileCountMax limit that throws FileCountLimitExceededException when exceeded. The complete fix was already present in the upstream Apache Tomcat 10.1.42 release (commit 8a2285f13a by Mark Thomas, Dec 13 2022) before TuxCare began maintaining this version. All defense components are present: FileCountLimitExceededException class, fileCountMax field in FileUploadBase, count check before processing each part (lines 457-459), Request.java configuration (line 2646), and Parameters.size() method (lines 122-124). The vulnerable pattern (unbounded part processing without count limit) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "CVE-2023-24998 is NOT present in Apache Tomcat 10.1.42. The vulnerability concerns unbounded processing of multipart file upload request parts leading to DoS through resource exhaustion. The fix adds a fileCountMax limit that throws FileCountLimitExceededException when exceeded. The complete fix was already present in the upstream Apache Tomcat 10.1.42 release (commit 8a2285f13a by Mark Thomas, Dec 13 2022) before TuxCare began maintaining this version. All defense components are present: FileCountLimitExceededException class, fileCountMax field in FileUploadBase, count check before processing each part (lines 457-459), Request.java configuration (line 2646), and Parameters.size() method (lines 122-124). The vulnerable pattern (unbounded part processing without count limit) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 affects Apache Tomcat's parameter counting logic in Parameters.java. The vulnerability is an off-by-one error where parameterCount was incremented BEFORE checking the limit (using '>'), allowing exactly one parameter over the limit to be processed. The target repository (Tomcat 10.1.42-tuxcare.11) contains the upstream fix (commit ba848da71c by Mark Thomas, dated 2023-04-11) which was included in upstream Tomcat 10.1.8 and all subsequent releases. The fix checks parameterCount >= limit BEFORE incrementing. The fix was present in the upstream 10.1.42 release that TuxCare onboarded (first TuxCare commit: 39e58930c6 \"Setup 10.1.42\"). Therefore, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "CVE-2023-28709 affects Apache Tomcat's parameter counting logic in Parameters.java. The vulnerability is an off-by-one error where parameterCount was incremented BEFORE checking the limit (using '>'), allowing exactly one parameter over the limit to be processed. The target repository (Tomcat 10.1.42-tuxcare.11) contains the upstream fix (commit ba848da71c by Mark Thomas, dated 2023-04-11) which was included in upstream Tomcat 10.1.8 and all subsequent releases. The fix checks parameterCount >= limit BEFORE incrementing. The fix was present in the upstream 10.1.42 release that TuxCare onboarded (first TuxCare commit: 39e58930c6 \"Setup 10.1.42\"). Therefore, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.42 is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced in version 10.1.8 (bug 66591) where responses with zero HTTP headers would not send an AJP SEND_HEADERS message, causing the proxy to reuse headers from previous requests. This was fixed upstream in version 10.1.9 (commit 2214c80305 by Mark Thomas). The target version 10.1.42 is 34 versions ahead and already contains the upstream fix - the code uses a while loop structure that guarantees SEND_HEADERS is always sent, even when numHeaders == 0. The fix was present in the upstream release when TuxCare onboarded version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "Apache Tomcat 10.1.42 is NOT affected by CVE-2023-34981. The vulnerability was a regression introduced in version 10.1.8 (bug 66591) where responses with zero HTTP headers would not send an AJP SEND_HEADERS message, causing the proxy to reuse headers from previous requests. This was fixed upstream in version 10.1.9 (commit 2214c80305 by Mark Thomas). The target version 10.1.42 is 34 versions ahead and already contains the upstream fix - the code uses a while loop structure that guarantees SEND_HEADERS is always sent, even when numHeaders == 0. The fix was present in the upstream release when TuxCare onboarded version 10.1.42.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T00:51:00.063334+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in target version 10.1.42. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The defense code (lines 766-769 in FormAuthenticator.java) strips consecutive leading slashes from saved request URLs, preventing protocol-relative redirect interpretation (e....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in target version 10.1.42. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The defense code (lines 766-769 in FormAuthenticator.java) strips consecutive leading slashes from saved request URLs, preventing protocol-relative redirect interpretation (e...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:22:18.734162+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability pattern (unlimited RST_STREAM frame processing without overhead tracking) was never present in the shipped version because the upstream Apache Tomcat 10.1.42 release already included the complete fix by Mark Thomas (October 2023). All three defense components are present and active by default: (1) RST frame overhead tracking with 50x weight, (2) PRIORITY_UPDATE frame overhead tracking, and (3) early parsing termination when overhead limit exceeded. Fix commit 76bb4bfbfeae827dce896f650655bbf6e251ed49 is an ancestor of the first TuxCare onboarding commit 39e58930c6, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability pattern (unlimited RST_STREAM frame processing without overhead tracking) was never present in the shipped version because the upstream Apache Tomcat 10.1.42 release already included the complete fix by Mark Thomas (October 2023). All three defense components are present and active by default: (1) RST frame overhead tracking with 50x weight, (2) PRIORITY_UPDATE frame overhead tracking, and (3) early parsing termination when overhead limit exceeded. Fix commit 76bb4bfbfeae827dce896f650655bbf6e251ed49 is an ancestor of the first TuxCare onboarding commit 39e58930c6, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:10:05.488784+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which validates that trailer header names contain only token characters and values do not contain control characters (except HT/tab), was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which validates that trailer header names contain only token characters and values do not contain control characters (except HT/tab), was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.42 is not affected by CVE-2023-46589. The vulnerability involves improper validation of HTTP trailer headers in chunked transfer-encoded requests, which could lead to request smuggling. According to the CVE, versions 10.1.16 onwards contain the fix. The target version 10.1.42 already includes the upstream fix that validates trailer header names using HttpParser.isToken() and trailer header values to reject control characters. The fix was authored by Mark Thomas (Apache committer) and shipped in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "Apache Tomcat 10.1.42 is not affected by CVE-2023-46589. The vulnerability involves improper validation of HTTP trailer headers in chunked transfer-encoded requests, which could lead to request smuggling. According to the CVE, versions 10.1.16 onwards contain the fix. The target version 10.1.42 already includes the upstream fix that validates trailer header names using HttpParser.isToken() and trailer header values to reject control characters. The fix was authored by Mark Thomas (Apache committer) and shipped in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:43:00.122669+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat's ErrorReportValve, which could leak sensitive information through error messages when I/O should not be allowed. The upstream fix (commit ce4f9a5e0e2 by Mark Thomas, 2021-02-24) adds a check for IS_IO_ALLOWED before flushing error data to clients. This fix is present in the target at ErrorReportValve.java:100-116 and was already included in the upstream Tom...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 affects Apache Tomcat's ErrorReportValve, which could leak sensitive information through error messages when I/O should not be allowed. The upstream fix (commit ce4f9a5e0e2 by Mark Thomas, 2021-02-24) adds a check for IS_IO_ALLOWED before flushing error data to clients. This fix is present in the target at ErrorReportValve.java:100-116 and was already included in the upstream Tom..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. 10.1.42 is not vulnerable. The issue is fixed in 10.1.19, and 10.1.42 is later than 10.1.19, so this version already includes the fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "10.1.42 is not vulnerable. The issue is fixed in 10.1.19, and 10.1.42 is later than 10.1.19, so this version already includes the fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 10.1.42 is not affected by CVE-2024-34750. The vulnerability (miscounting of active HTTP/2 streams leading to incorrect infinite timeout) was fixed by upstream Apache in version 10.1.25. Since the target is version 10.1.42, the fix was already present in the upstream release when TuxCare onboarded it. The complete fix includes: AtomicBoolean removedFromActiveCount to prevent double-decrementing, decrementAndGetActiveRemoteStreamCount() method with compareAndSet protection, and corrected increment logic in headersStart(). All components are present and properly integrated across Http2UpgradeHandler, Http2AsyncUpgradeHandler, and Stream classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "impact_statement": "The target Apache Tomcat 10.1.42 is not affected by CVE-2024-34750. The vulnerability (miscounting of active HTTP/2 streams leading to incorrect infinite timeout) was fixed by upstream Apache in version 10.1.25. Since the target is version 10.1.42, the fix was already present in the upstream release when TuxCare onboarded it. The complete fix includes: AtomicBoolean removedFromActiveCount to prevent double-decrementing, decrementAndGetActiveRemoteStreamCount() method with compareAndSet protection, and corrected increment logic in headersStart(). All components are present and properly integrated across Http2UpgradeHandler, Http2AsyncUpgradeHandler, and Stream classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.42 is not affected by CVE-2024-38286. The vulnerability pattern (unbounded accumulation of TLS handshake wrap requests leading to OutOfMemoryError) is not present because the fix was already included in the upstream Apache Tomcat 10.1.25 release, which TuxCare later onboarded as version 10.1.42. The fix adds limits and validation to prevent memory exhaustion during TLS re-keying operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "impact_statement": "Target version 10.1.42 is not affected by CVE-2024-38286. The vulnerability pattern (unbounded accumulation of TLS handshake wrap requests leading to OutOfMemoryError) is not present because the fix was already included in the upstream Apache Tomcat 10.1.25 release, which TuxCare later onboarded as version 10.1.42. The fix adds limits and validation to prevent memory exhaustion during TLS re-keying operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:13.268056+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target version 10.1.42-tuxcare.11 is NOT AFFECTED by CVE-2024-50379. The vulnerable pattern (unsynchronized resource access causing FileResource metadata corruption on case-insensitive filesystems) is not present. The complete upstream fix was included in Apache Tomcat 10.1.42 before TuxCare onboarded it. Both the main fix (commit 8554f6b172 adding read/write locks with normalized, case-folded path keys) and follow-up fix (commit 05ddeeaa54 ensuring ResourceLock is added to map) were authored by Mark Thomas (markt@apache.org) and shipped in the upstream release. The fix protects all three critical operations: getResource(), write(), and delete().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "impact_statement": "Target version 10.1.42-tuxcare.11 is NOT AFFECTED by CVE-2024-50379. The vulnerable pattern (unsynchronized resource access causing FileResource metadata corruption on case-insensitive filesystems) is not present. The complete upstream fix was included in Apache Tomcat 10.1.42 before TuxCare onboarded it. Both the main fix (commit 8554f6b172 adding read/write locks with normalized, case-folded path keys) and follow-up fix (commit 05ddeeaa54 ensuring ResourceLock is added to map) were authored by Mark Thomas (markt@apache.org) and shipped in the upstream release. The fix protects all three critical operations: getResource(), write(), and delete().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 10.1.42 is not affected by CVE-2024-52317. The vulnerability (incorrect HTTP/2 request/response recycling leading to cross-user contamination) was fixed in upstream release 10.1.31 by commit 146f94f8 authored by Mark Thomas (markt@apache.org). The target version 10.1.42 includes this upstream fix, which splits Stream.recycle() into replace() and recycle() methods and ad...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 10.1.42 is not affected by CVE-2024-52317. The vulnerability (incorrect HTTP/2 request/response recycling leading to cross-user contamination) was fixed in upstream release 10.1.31 by commit 146f94f8 authored by Mark Thomas (markt@apache.org). The target version 10.1.42 includes this upstream fix, which splits Stream.recycle() into replace() and recycle() methods and ad..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-56337 does not affect this target. The vulnerability patterns are not present because the fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The CVE affects versions 10.1.0-M1 through 10.1.33, and the fix was released in 10.1.35+. The target version 10.1.42 includes both the locking mechanism (from CVE-2024-50379) and the canon cache checks (CVE-2024-56337 specific) authored by upstream Apache Tomcat maintainers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "impact_statement": "CVE-2024-56337 does not affect this target. The vulnerability patterns are not present because the fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The CVE affects versions 10.1.0-M1 through 10.1.33, and the fix was released in 10.1.35+. The target version 10.1.42 includes both the locking mechanism (from CVE-2024-50379) and the canon cache checks (CVE-2024-56337 specific) authored by upstream Apache Tomcat maintainers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 10.1.42 is not affected by CVE-2025-24813. The vulnerability involving predictable temporary filenames in DefaultServlet's partial PUT handling was fixed in upstream commit f6c01d6577 (Jan 24, 2025) by remm@apache.org. This fix was already present in the upstream 10.1.42 release before TuxCare onboarded it (first TuxCare commit 39e58930c6 on Mar 11, 2026). The vulnerable pattern (convertedResourcePath = path.replace('/', '.')) is absent from HEAD; the secure pattern (File.createTempFile) is present with proper cleanup in the finally block.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "impact_statement": "Target Apache Tomcat 10.1.42 is not affected by CVE-2025-24813. The vulnerability involving predictable temporary filenames in DefaultServlet's partial PUT handling was fixed in upstream commit f6c01d6577 (Jan 24, 2025) by remm@apache.org. This fix was already present in the upstream 10.1.42 release before TuxCare onboarded it (first TuxCare commit 39e58930c6 on Mar 11, 2026). The vulnerable pattern (convertedResourcePath = path.replace('/', '.')) is absent from HEAD; the secure pattern (File.createTempFile) is present with proper cleanup in the finally block.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:13.268056+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.42 is NOT affected by CVE-2025-31650. The vulnerability (improper error handling for invalid HTTP/2 priority headers causing memory leaks) was fixed by upstream Apache Tomcat in March 2025 and included in the official 10.1.42 release (tagged June 2025). TuxCare onboarded version 10.1.42 in March 2026, after the upstream fix was already present. The fix adds try-catch blocks around Priority.parsePriority() calls in Http2Parser.java and Stream.java to catch IllegalArgumentException and prevent incomplete request cleanup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Apache Tomcat 10.1.42 is NOT affected by CVE-2025-31650. The vulnerability (improper error handling for invalid HTTP/2 priority headers causing memory leaks) was fixed by upstream Apache Tomcat in March 2025 and included in the official 10.1.42 release (tagged June 2025). TuxCare onboarded version 10.1.42 in March 2026, after the upstream fix was already present. The fix adds try-catch blocks around Priority.parsePriority() calls in Http2Parser.java and Stream.java to catch IllegalArgumentException and prevent incomplete request cleanup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.1, < 11.0.6; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 9.0.76, <= 9.0.102; >= 10.1.10, <= 10.1.39; >= 11.0.0-M2, <= 11.0.5; >= 8.5.90, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:32.418284+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target (Tomcat 10.1.42) is not affected by CVE-2025-31651. The vulnerability allowed bypassing rewrite rules via specially crafted URLs containing literal '%', ';', or '?' characters that were confused with structural delimiters. The fix was already present in upstream Apache Tomcat 10.1.42 when TuxCare onboarded it. The fix adds encodeForRewrite() to encode literal special characters before rewrite rule evaluation, and removes semicolon-stripping code from CoyoteAdapter. Fix commit 066bf6b6 authored by Mark Thomas (Apache) is an ancestor of the onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "impact_statement": "The target (Tomcat 10.1.42) is not affected by CVE-2025-31651. The vulnerability allowed bypassing rewrite rules via specially crafted URLs containing literal '%', ';', or '?' characters that were confused with structural delimiters. The fix was already present in upstream Apache Tomcat 10.1.42 when TuxCare onboarded it. The fix adds encodeForRewrite() to encode literal special characters before rewrite rule evaluation, and removes semicolon-stripping code from CoyoteAdapter. Fix commit 066bf6b6 authored by Mark Thomas (Apache) is an ancestor of the onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.104; >= 10.1.0, < 10.1.40; >= 11.0.0, < 11.0.6), cve.org (>= 11.0.0-M1, <= 11.0.5; >= 10.1.0-M1, <= 10.1.39; >= 9.0.0.M1, <= 9.0.102; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6; >= 9.0.76, < 9.0.104; >= 10.1.10, < 10.1.40; >= 11.0.0-M2, < 11.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2025-46701. The vulnerability involved improper case sensitivity handling in the CGI servlet's findCGI() method, where File API-based path resolution (case-insensitive on Windows/macOS) could bypass case-sensitive security constraints. The upstream fix refactored the code to use WebResource API with explicit isFile() checks, providing consistent case-sensitive URL-based path resolution. This fix (commits 238d2aa5 and 2c68001 by Mark Thomas) was already present in Apache Tomcat 10.1.42 when TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "impact_statement": "Apache Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2025-46701. The vulnerability involved improper case sensitivity handling in the CGI servlet's findCGI() method, where File API-based path resolution (case-insensitive on Windows/macOS) could bypass case-sensitive security constraints. The upstream fix refactored the code to use WebResource API with explicit isFile() checks, providing consistent case-sensitive URL-based path resolution. This fix (commits 238d2aa5 and 2c68001 by Mark Thomas) was already present in Apache Tomcat 10.1.42 when TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.105; >= 10.1.0, < 10.1.41; >= 11.0.0, < 11.0.7), cve.org (>= 11.0.0-M1, <= 11.0.6; >= 10.1.0-M1, <= 10.1.40; >= 9.0.0.M1, <= 9.0.104; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7; >= 9.0.0.M1, < 9.0.105; >= 10.1.0-M1, < 10.1.41; >= 11.0.0-M1, < 11.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. 10.1.42 is the first fixed release in 10.1.x. The fix is already included in 10.1.42.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "impact_statement": "10.1.42 is the first fixed release in 10.1.x. The fix is already included in 10.1.42."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:39:13.268056+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT vulnerable to CVE-2025-49124. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and this fix was already present when TuxCare onboarded the 10.1.42 release. All three icacls.exe invocations in the Windows installer script (res/install-win/tomcat.nsi at lines 382, 395, 408) use the full system path ($SYSDIR\\icacls) instead of relying on PATH search, preventing untrusted search path attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "impact_statement": "The target repository (Apache Tomcat 10.1.42-tuxcare.11) is NOT vulnerable to CVE-2025-49124. The vulnerability was fixed in upstream Apache Tomcat 10.1.42, and this fix was already present when TuxCare onboarded the 10.1.42 release. All three icacls.exe invocations in the Windows installer script (res/install-win/tomcat.nsi at lines 382, 395, 408) use the full system path ($SYSDIR\\icacls) instead of relying on PATH search, preventing untrusted search path attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106; >= 11.0.0-M1, < 11.0.8; >= 10.1.0, < 10.1.42; >= 9.0.23, < 9.0.106), NVD (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0, < 11.0.8), cve.org (>= 11.0.0-M1, <= 11.0.7; >= 10.1.0, <= 10.1.41; >= 9.0.23, <= 9.0.105; >= 8.5.44, <= 8.5.100; >= 7.0.95, <= 7.0.109), Snyk (>= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8; >= 9.0.23, < 9.0.106; >= 10.1.0, < 10.1.42; >= 11.0.0-M1, < 11.0.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. 10.1.42 is the first fixed release in 10.1.x. The fix is already included in 10.1.42.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "impact_statement": "10.1.42 is the first fixed release in 10.1.x. The fix is already included in 10.1.42."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 10.1.42 is not affected by CVE-2025-52434. The vulnerability exists in the APR/Native connector (AprEndpoint.java), which was completely removed from Tomcat 10.1.x in upstream commit 314568fa45 (August 2021) before version 10.1.42 was released. The target uses NIO/NIO2 connectors instead, which have fundamentally different socket handling and do not have the APR-specific race condition vulnerability. TuxCare backported this CVE fix to 8.5.x and 9.0.x versions that still use APR, but no 10.1.x backports exist because the vulnerable code is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "impact_statement": "Tomcat 10.1.42 is not affected by CVE-2025-52434. The vulnerability exists in the APR/Native connector (AprEndpoint.java), which was completely removed from Tomcat 10.1.x in upstream commit 314568fa45 (August 2021) before version 10.1.42 was released. The target uses NIO/NIO2 connectors instead, which have fundamentally different socket handling and do not have the APR-specific race condition vulnerability. TuxCare backported this CVE fix to 8.5.x and 9.0.x versions that still use APR, but no 10.1.x backports exist because the vulnerable code is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100; >= 9.0.0.M1, < 9.0.107; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.107), cve.org (>= 9.0.0.M1, <= 9.0.106; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.107)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T20:40:53.651459+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 10.1.42-tuxcare.11 is NOT AFFECTED by CVE-2025-55668. The vulnerability (session fixation via RewriteValve failing to encode session IDs in redirect URLs) was fixed in upstream commit 8621e4c6ba by remm@apache.org on June 3, 2025. This fix was already present in Apache Tomcat 10.1.42 when TuxCare onboarded it on March 11, 2026 (commit 39e58930c6). All three protective c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 10.1.42-tuxcare.11 is NOT AFFECTED by CVE-2025-55668. The vulnerability (session fixation via RewriteValve failing to encode session IDs in redirect URLs) was fixed in upstream commit 8621e4c6ba by remm@apache.org on June 3, 2025. This fix was already present in Apache Tomcat 10.1.42 when TuxCare onboarded it on March 11, 2026 (commit 39e58930c6). All three protective c..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.10."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:31:30.745035+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 10.1.42 is NOT affected by CVE-2026-29129. The vulnerability (cipher preference order not preserved) was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added using HashSet, which doesn't preserve order. Version 10.1.42 predates this change and uses LinkedHashSet throughout the cipher handling pipeline, correctly preserving the configured cipher preference order. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Tomcat 10.1.42 is NOT affected by CVE-2026-29129. The vulnerability (cipher preference order not preserved) was introduced in version 10.1.51 when TLS 1.3 cipher suite support was added using HashSet, which doesn't preserve order. Version 10.1.42 predates this change and uses LinkedHashSet throughout the cipher handling pipeline, correctly preserving the configured cipher preference order. The ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T15:11:53.681251+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 10.1.42-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 10.1.42-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}