{
  "@id": "urn:uuid:16c81ae3-c8bc-4254-8535-02ef425ffa49",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 61,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:17:00.447062+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 7.0.109. The vulnerability was an XSS issue in the host-manager HTML interface where the hostname parameter was not properly HTML-escaped when rendered in responses. The fix was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The fix adds HTML escaping via RequestUtil.filter() for all hostname outputs in the HT...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 7.0.109. The vulnerability was an XSS issue in the host-manager HTML interface where the hostname parameter was not properly HTML-escaped when rendered in responses. The fix was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The fix adds HTML escaping via RequestUtil.filter() for all hostname outputs in the HT..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:12:27.199890+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects only Apache Tomcat 8.x before 8.0.4. The vulnerability was a regression introduced in Tomcat 8.0.0-RC2 as part of Servlet 3.1 non-blocking I/O support. Tomcat 7.0.109 implements Servlet 3.0 and does not contain the Servlet 3.1 non-blocking I/O code that introduced this regression. The target uses a simpler AJP processor architecture that handles Content-Length: 0 requests ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 affects only Apache Tomcat 8.x before 8.0.4. The vulnerability was a regression introduced in Tomcat 8.0.0-RC2 as part of Servlet 3.1 non-blocking I/O support. Tomcat 7.0.109 implements Servlet 3.0 and does not contain the Servlet 3.1 non-blocking I/O code that introduced this regression. The target uses a simpler AJP processor architecture that handles Content-Length: 0 requests ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 7.0.109 is not affected by CVE-2017-12615. The vulnerability affected versions 7.0.0 to 7.0.79 and was fixed by Apache in version 7.0.80 (August 2017). The target version 7.0.109 already includes the upstream fix commits (e862b0c259b4c867553df29cef1af9e904af83b0 and 07dc0ea2745f0afab6415f22b16a29f1c6de5727) authored by Mark Thomas (markt@apache.org). These fixes were shipped in the upstream release and brought in during the TuxCare onboarding commit 1ec77923c0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Apache Tomcat 7.0.109 is not affected by CVE-2017-12615. The vulnerability affected versions 7.0.0 to 7.0.79 and was fixed by Apache in version 7.0.80 (August 2017). The target version 7.0.109 already includes the upstream fix commits (e862b0c259b4c867553df29cef1af9e904af83b0 and 07dc0ea2745f0afab6415f22b16a29f1c6de5727) authored by Mark Thomas (markt@apache.org). These fixes were shipped in the upstream release and brought in during the TuxCare onboarding commit 1ec77923c0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 Apache Tomcat 7.0.109 is outside the affected range for CVE-2017-12617 (7.0.0\u20137.0.81). The vulnerability was fixed upstream in 7.0.82, with a follow-up correction in 7.0.89, so 7.0.109 carries the complete fix. The affected components \u2014 FileDirContext, VirtualDirContext, JrePlatform and DefaultServlet \u2014 are byte-identical to the corresponding files in the upstream Apache Tomcat 7.0.109 release, and the upstream regression tests for this CVE are present and unmodified.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "already_fixed \u2014 Apache Tomcat 7.0.109 is outside the affected range for CVE-2017-12617 (7.0.0\u20137.0.81). The vulnerability was fixed upstream in 7.0.82, with a follow-up correction in 7.0.89, so 7.0.109 carries the complete fix. The affected components \u2014 FileDirContext, VirtualDirContext, JrePlatform and DefaultServlet \u2014 are byte-identical to the corresponding files in the upstream Apache Tomcat 7.0.109 release, and the upstream regression tests for this CVE are present and unmodified."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 affects Apache Tomcat 7.0.0-7.0.75",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 affects Apache Tomcat 7.0.0-7.0.75"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 only; 7.0.x is not affected",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 only; 7.0.x is not affected"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 7.0.109 is NOT AFFECTED by CVE-2018-11784. The vulnerability (protocol-relative redirect allowing open redirect attacks) has been fixed in the upstream Apache Tomcat 7.0.109 release. The fix (stripping leading slashes to prevent \"//\" in redirect URLs) is present at lines 1095-1098 in DefaultServlet.java. This fix was introduced by upstream Apache commit b76e1dfb3d by Ma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 7.0.109 is NOT AFFECTED by CVE-2018-11784. The vulnerability (protocol-relative redirect allowing open redirect attacks) has been fixed in the upstream Apache Tomcat 7.0.109 release. The fix (stripping leading slashes to prevent \"//\" in redirect URLs) is present at lines 1095-1098 in DefaultServlet.java. This fix was introduced by upstream Apache commit b76e1dfb3d by Ma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 affects Apache Tomcat 7.0.0 to 7.0.84. The target repository is Tomcat 7.0.109, which already includes the upstream vendor fix (commit 2d69fde135 by Mark Thomas from Apache, applied in version 7.0.85). Both required defenses are present in RealmBase.java: (1) empty string URI normalization to \"/\" at line 702, and (2) explicit pattern matching for empty string patterns with context...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 affects Apache Tomcat 7.0.0 to 7.0.84. The target repository is Tomcat 7.0.109, which already includes the upstream vendor fix (commit 2d69fde135 by Mark Thomas from Apache, applied in version 7.0.85). Both required defenses are present in RealmBase.java: (1) empty string URI normalization to \"/\" at line 702, and (2) explicit pattern matching for empty string patterns with context..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) is NOT vulnerable to CVE-2018-1305. The vulnerability affected versions 7.0.0 to 7.0.84, and was fixed in 7.0.85. The target version includes the complete fix: ServletSecurity annotations are processed at application startup rather than lazily at servlet load time, eliminating the timing-dependent security constraint application issue.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) is NOT vulnerable to CVE-2018-1305. The vulnerability affected versions 7.0.0 to 7.0.84, and was fixed in 7.0.85. The target version includes the complete fix: ServletSecurity annotations are processed at application startup rather than lazily at servlet load time, eliminating the timing-dependent security constraint application issue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Patches already applied: e00812b94e5830b2be3de04f4ae4ade38a700074 (already in target via 156d76a6af 'Improve handing of overflow in the UTF-8 decoder with supplementary characters.')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "Patches already applied: e00812b94e5830b2be3de04f4ae4ade38a700074 (already in target via 156d76a6af 'Improve handing of overflow in the UTF-8 decoder with supplementary characters.')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 CVE-2018-8014 fix is already present in the target repository. The target (Tomcat 7.0.109-tuxcare.1) contains commit 5877390a96 which addresses the insecure CORS filter defaults. All three critical security changes from the vendor patch are present: (1) DEFAULT_ALLOWED_ORIGINS changed to empty string, (2) DEFAULT_SUPPORTS_CREDENTIALS changed to false, and (3) validation logic added to prevent t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "already_fixed \u2014 CVE-2018-8014 fix is already present in the target repository. The target (Tomcat 7.0.109-tuxcare.1) contains commit 5877390a96 which addresses the insecure CORS filter defaults. All three critical security changes from the vendor patch are present: (1) DEFAULT_ALLOWED_ORIGINS changed to empty string, (2) DEFAULT_SUPPORTS_CREDENTIALS changed to false, and (3) validation logic added to prevent t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 (missing hostname verification for WebSocket TLS connections) is NOT present in Apache Tomcat 7.0.109-tuxcare.4. The upstream Apache vendor already fixed this vulnerability in commit 2c52279516 (June 18, 2018) by enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\") in the SSLEngine configuration. This fix was included in the upstream 7.0.109 release (April 22, 2021), and the TuxCare-maintained version inherited this already-fixed state when the 7.0.109 baseline was onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 (missing hostname verification for WebSocket TLS connections) is NOT present in Apache Tomcat 7.0.109-tuxcare.4. The upstream Apache vendor already fixed this vulnerability in commit 2c52279516 (June 18, 2018) by enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\") in the SSLEngine configuration. This fix was included in the upstream 7.0.109 release (April 22, 2021), and the TuxCare-maintained version inherited this already-fixed state when the 7.0.109 baseline was onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:17:00.447062+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because socket locking, processor ownership and one-time connection cleanup block the response-mixing race. Timeout handling locks the socket and retrieves its associated processor (java/org/apache/tomcat/util/net/NioEndpoint.java:1740; java/org/apache/coyote/AbstractProtocol.java:599). Connection closure releases the processor association and recycles the channel only once (java/org/apache/tomcat/util/net/NioEndpoint.java:1126; java/org/apache/tomcat/util/net/NioEndpoint.java:1834).",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because socket locking, processor ownership and one-time connection cleanup block the response-mixing race. Timeout handling locks the socket and retrieves its associated processor (java/org/apache/tomcat/util/net/NioEndpoint.java:1740; java/org/apache/coyote/AbstractProtocol.java:599). Connection closure releases the processor association and recycles the channel only once (java/org/apache/tomcat/util/net/NioEndpoint.java:1126; java/org/apache/tomcat/util/net/NioEndpoint.java:1834)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "action_statement": "Vulnerability CVE-2019-0199 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 7.0.109. The vulnerability affected SSI printenv command's lack of HTML entity encoding (versions 7.0.0-7.0.93). The target already contains the upstream fix (commit 44ec74c44d by Mark Thomas, 2019-03-11) which adds entity encoding via SSIMediator.ENCODING_ENTITY. This fix was shipped in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded on ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 7.0.109. The vulnerability affected SSI printenv command's lack of HTML entity encoding (versions 7.0.0-7.0.93). The target already contains the upstream fix (commit 44ec74c44d by Mark Thomas, 2019-03-11) which adds entity encoding via SSIMediator.ENCODING_ENTITY. This fix was shipped in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded on ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 is not present in Apache Tomcat 7.0.109. The vulnerability affected Tomcat 7.0.0 to 7.0.93, but the fix was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The fix (commit 7f0221b904) was authored by Mark Thomas (markt@apache.org) and shipped in the upstream 7.0.94+ releases. The target version contains the complete mitigation: validation of decoded CGI command line arguments against a restrictive pattern on Windows to prevent command injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 is not present in Apache Tomcat 7.0.109. The vulnerability affected Tomcat 7.0.0 to 7.0.93, but the fix was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The fix (commit 7f0221b904) was authored by Mark Thomas (markt@apache.org) and shipped in the upstream 7.0.94+ releases. The target version contains the complete mitigation: validation of decoded CGI command line arguments against a restrictive pattern on Windows to prevent command injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:15:41.281614+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-q4hg-rmq2-52q9 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-q4hg-rmq2-52q9 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 CVE-2019-12418 has been fixed in this Tomcat 7.0.109-tuxcare.1 repository. The security fix from commit bef3f40400 (November 14, 2019) is present. The vulnerable standard RMI registry that allowed bind/unbind/rebind operations has been replaced with a custom immutable JmxRegistry class that prevents registry manipulation attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-12418 has been fixed in this Tomcat 7.0.109-tuxcare.1 repository. The security fix from commit bef3f40400 (November 14, 2019) is present. The vulnerable standard RMI registry that allowed bind/unbind/rebind operations has been replaced with a custom immutable JmxRegistry class that prevents registry manipulation attacks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The vulnerability pattern described in CVE-2019-17563 is not present in Apache Tomcat 7.0.109. The fix for the session fixation vulnerability was already included in the upstream Apache Tomcat 7.0.109 release (commit ab72a106fe5d992abddda954e30849d7cf8cc583 by Mark Thomas, dated 2019-12-05) before TuxCare onboarded this version. The CVE affected Tomcat 7.0.0 to 7.0.98; version 7.0.109 is outside this range. The vulnerable code patterns (storing Principal via FORM_PRINCIPAL_NOTE when cache=false, early checkForCachedAuthentication placement) are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "The vulnerability pattern described in CVE-2019-17563 is not present in Apache Tomcat 7.0.109. The fix for the session fixation vulnerability was already included in the upstream Apache Tomcat 7.0.109 release (commit ab72a106fe5d992abddda954e30849d7cf8cc583 by Mark Thomas, dated 2019-12-05) before TuxCare onboarded this version. The CVE affected Tomcat 7.0.0 to 7.0.98; version 7.0.109 is outside this range. The vulnerable code patterns (storing Principal via FORM_PRINCIPAL_NOTE when cache=false, early checkForCachedAuthentication placement) are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 7.0.109 is not affected by CVE-2019-17569. The vulnerability was a regression introduced in Tomcat 7.0.98-7.0.99 where invalid Transfer-Encoding headers were incorrectly ignored instead of being rejected, enabling HTTP Request Smuggling. The upstream fix (commit b191a0d9cf) was already included in the Tomcat 7.0.109 release that TuxCare onboarded. The current code properly valida...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Target version 7.0.109 is not affected by CVE-2019-17569. The vulnerability was a regression introduced in Tomcat 7.0.98-7.0.99 where invalid Transfer-Encoding headers were incorrectly ignored instead of being rejected, enabling HTTP Request Smuggling. The upstream fix (commit b191a0d9cf) was already included in the Tomcat 7.0.109 release that TuxCare onboarded. The current code properly valida..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 fix is present in target Tomcat 7.0.109. The vulnerability allowed HTTP request smuggling via invalid control characters in header values. The upstream fix (commit 702bf15bea, 2020-01-06) added strict validation: (1) rejects standalone CR not followed by LF, (2) rejects control characters (0x00-0x1F except TAB, 0x7F) in header values via HttpParser.isControl(), (3) removes invalid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 fix is present in target Tomcat 7.0.109. The vulnerability allowed HTTP request smuggling via invalid control characters in header values. The upstream fix (commit 702bf15bea, 2020-01-06) added strict validation: (1) rejects standalone CR not followed by LF, (2) rejects control characters (0x00-0x1F except TAB, 0x7F) in header values via HttpParser.isControl(), (3) removes invalid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is NOT present in Apache Tomcat 7.0.109. The vulnerability affects versions 7.0.0-7.0.99 and was fixed in 7.0.100+. The target version 7.0.109 contains all three upstream defense mechanisms: (1) AJP default bind to loopback address (127.0.0.1), (2) secret authentication with secretRequired=true validation that rejects unauthenticated AJP connections with 403, and (3) arbitrary request attribute filtering that blocks unrecognized AJP attributes unless they match allowedRequestAttributesPattern (defaults to null, rejecting all arbitrary attributes). The fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream Apache Tomcat 7.0.109 release, which TuxCare onboarded via commit 1ec77923c02. No TuxCare-specific backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is NOT present in Apache Tomcat 7.0.109. The vulnerability affects versions 7.0.0-7.0.99 and was fixed in 7.0.100+. The target version 7.0.109 contains all three upstream defense mechanisms: (1) AJP default bind to loopback address (127.0.0.1), (2) secret authentication with secretRequired=true validation that rejects unauthenticated AJP connections with 403, and (3) arbitrary request attribute filtering that blocks unrecognized AJP attributes unless they match allowedRequestAttributesPattern (defaults to null, rejecting all arbitrary attributes). The fix was authored by Mark Thomas (markt@apache.org) and shipped in the upstream Apache Tomcat 7.0.109 release, which TuxCare onboarded via commit 1ec77923c02. No TuxCare-specific backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T11:03:11.209964+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 7.0.109 is not vulnerable as it is higher than upstream fix version - 7.0.108",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Tomcat 7.0.109 is not vulnerable as it is higher than upstream fix version - 7.0.108"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 7.0.0-7.0.106",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 7.0.0-7.0.106"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 7.0.109 is not vulnerable to CVE-2021-25329. The fix for this incomplete CVE-2020-9484 patch was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The vulnerable FileUtil implementation (using File.pathSeparator) was corrected to use File.separator in upstream commit 7c3fb673f4 on 2021-01-20, before the 7.0.109 release tag on 2021-04-22. All five affected files (FileStore, ExpandWar, DefaultServlet, ContextConfig, HostConfig) use the corrected FileUtil implementation, and no vulnerable string-based path checking patterns remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "Target Tomcat 7.0.109 is not vulnerable to CVE-2021-25329. The fix for this incomplete CVE-2020-9484 patch was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The vulnerable FileUtil implementation (using File.pathSeparator) was corrected to use File.separator in upstream commit 7c3fb673f4 on 2021-01-20, before the 7.0.109 release tag on 2021-04-22. All five affected files (FileStore, ExpandWar, DefaultServlet, ContextConfig, HostConfig) use the corrected FileUtil implementation, and no vulnerable string-based path checking patterns remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:12:12.887949+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "action_statement": "Vulnerability CVE-2022-42252 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-22T14:27:21.818338+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "action_statement": "Vulnerability CVE-2022-45143 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:11:34.688190+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:25:20.621635+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "action_statement": "Vulnerability CVE-2023-28709 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:38:00.054920+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the method the fix changes and its callers are absent, and the code the fix removes is gone. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mppv-79ch-vw6q (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the method the fix changes and its callers are absent, and the code the fix removes is gone. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mppv-79ch-vw6q (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:25:20.621635+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "action_statement": "Vulnerability CVE-2023-41080 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "action_statement": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:25:20.621635+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "action_statement": "Vulnerability CVE-2023-46589 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:14:00.036668+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its input buffers prevent stale request data from entering error messages. NIO resets valid bounds before body reads and exposes only positively counted bytes (java/org/apache/coyote/http11/InternalNioInputBuffer.java:860; java/org/apache/coyote/http11/InternalNioInputBuffer.java:479). Error-message extraction stops at the valid-data boundary, excluding unused buffer contents (java/org/apache/coyote/http11/AbstractInputBuffer.java:187).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its input buffers prevent stale request data from entering error messages. NIO resets valid bounds before body reads and exposes only positively counted bytes (java/org/apache/coyote/http11/InternalNioInputBuffer.java:860; java/org/apache/coyote/http11/InternalNioInputBuffer.java:479). Error-message extraction stops at the valid-data boundary, excluding unused buffer contents (java/org/apache/coyote/http11/AbstractInputBuffer.java:187)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "action_statement": "Vulnerability CVE-2024-38286 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-52317 does not affect Tomcat 7.0.109 because this version does not support HTTP/2. The vulnerability is specific to HTTP/2 stream recycling logic in the org.apache.coyote.http2 package, which does not exist in Tomcat 7.x. HTTP/2 support was introduced in Tomcat 8.5 and later versions. The target only implements HTTP/1.1 and AJP protocols. Exhaustive search confirmed zero HTTP/2 code pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-52317 does not affect Tomcat 7.0.109 because this version does not support HTTP/2. The vulnerability is specific to HTTP/2 stream recycling logic in the org.apache.coyote.http2 package, which does not exist in Tomcat 7.x. HTTP/2 support was introduced in Tomcat 8.5 and later versions. The target only implements HTTP/1.1 and AJP protocols. Exhaustive search confirmed zero HTTP/2 code pr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "action_statement": "Vulnerability CVE-2025-24813 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "action_statement": "Vulnerability CVE-2025-31650 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T21:00:35.277593+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:25:20.621635+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "action_statement": "Vulnerability CVE-2025-46701 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "action_statement": "Vulnerability CVE-2025-48989 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Version 7.0.109 is not vulnerable. Summary: CVE-2025-49125 does not affect this Tomcat instance. The target is running Tomcat 7.0.109, which predates the introduction of the vulnerable PreResources/PostResources features. These features were introduced in Tomcat 8.0 as part of the WebResourceRoot API. The CVE explicitly lists only Tomcat 9.x, 10.x, and 11.x as affected versions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "impact_statement": "Version 7.0.109 is not vulnerable. Summary: CVE-2025-49125 does not affect this Tomcat instance. The target is running Tomcat 7.0.109, which predates the introduction of the vulnerable PreResources/PostResources features. These features were introduced in Tomcat 8.0 as part of the WebResourceRoot API. The CVE explicitly lists only Tomcat 9.x, 10.x, and 11.x as affected versions."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "action_statement": "Vulnerability CVE-2025-52434 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "action_statement": "Vulnerability CVE-2025-52520 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      },
      "action_statement": "Vulnerability CVE-2025-53506 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T20:42:04.886450+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2025-55668 is a session fixation vulnerability in Apache Tomcat's RewriteValve component, which processes redirects without properly encoding session IDs. However, Tomcat 7.0.109 does not contain the RewriteValve component at all. RewriteValve was introduced in Tomcat 8.0 (January 2013) and never existed in the Tomcat 7 branch. Exhaustive searches of the codebase, directory structure, and g...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-55668 is a session fixation vulnerability in Apache Tomcat's RewriteValve component, which processes redirects without properly encoding session IDs. However, Tomcat 7.0.109 does not contain the RewriteValve component at all. RewriteValve was introduced in Tomcat 8.0 (January 2013) and never existed in the Tomcat 7 branch. Exhaustive searches of the codebase, directory structure, and g..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:25:20.621635+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      },
      "action_statement": "Vulnerability CVE-2025-61795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 7.0.109-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T20:01:16.621327+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:31:30.745035+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 7.0.109 is NOT AFFECTED by CVE-2026-29129. The vulnerability exists in SSLHostConfig.java's getJsseCipherNames() method which uses HashSet (losing cipher order). Version 7.0.109 does not have SSLHostConfig.java - it uses an older architecture (JSSESocketFactory) that processes ciphers with ArrayList, which preserves the configured order. The vulnerable code pattern was introduced ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 7.0.109 is NOT AFFECTED by CVE-2026-29129. The vulnerability exists in SSLHostConfig.java's getJsseCipherNames() method which uses HashSet (losing cipher order). Version 7.0.109 does not have SSLHostConfig.java - it uses an older architecture (JSSESocketFactory) that processes ciphers with ArrayList, which preserves the configured order. The vulnerable code pattern was introduced ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:23:27.725950+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:20:00.071166+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.109-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 7.0.109-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}