{ "@id": "urn:uuid:c5e233eb-78bb-472a-9a95-7d4282ae1193", "role": "Document Creator", "author": "https://tuxcare.com", "version": 59, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T16:52:53.138657+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T16:14:34.572852+00:00", "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 9.0.100. The XSS vulnerability in the host-manager HTML interface was fixed by upstream Apache in 2008 (commit 49c71fc59c by Mark Thomas). This fix has been present in all Tomcat 9.0.x releases since 9.0.0-M1, including the 9.0.100 release that TuxCare onboarded. The current code properly escapes all user-controlled input (hostname, aliases, message...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-1947" }, "impact_statement": "not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 9.0.100. The XSS vulnerability in the host-manager HTML interface was fixed by upstream Apache in 2008 (commit 49c71fc59c by Mark Thomas). This fix has been present in all Tomcat 9.0.x releases since 9.0.0-M1, including the 9.0.100 release that TuxCare onboarded. The current code properly escapes all user-controlled input (hostname, aliases, message..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T16:07:05.916705+00:00", "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affected Apache Tomcat 8.x before 8.0.4, causing thread consumption DoS when processing AJP requests with Content-Length: 0. The target (Tomcat 9.0.100) is not affected because the upstream fix was already present in the release. The fix (commit 8884dae60ac from March 2014 by markt@apache.org) adds explicit handling for zero-length content in the refillReadBuffer method, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0095" }, "impact_statement": "not_affected \u2014 CVE-2014-0095 affected Apache Tomcat 8.x before 8.0.4, causing thread consumption DoS when processing AJP requests with Content-Length: 0. The target (Tomcat 9.0.100) is not affected because the upstream fix was already present in the release. The fix (commit 8884dae60ac from March 2014 by markt@apache.org) adds explicit handling for zero-length content in the refillReadBuffer method, preventin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.100 is not affected by CVE-2017-12615. The vulnerable FileDirContext class from Tomcat 7 does not exist in Tomcat 9. The entire resource handling architecture was refactored in Tomcat 8.0+ to use WebResourceRoot with mandatory path validation. All file write operations go through StandardRoot.write() which calls validate() to normalize paths and prevent traversal. The RequestUtil.normalize() method returns null for paths attempting to escape the root, causing validation to throw exceptions. There is no code path from HTTP PUT requests to writing files outside the document root.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2017-12615" }, "impact_statement": "Tomcat 9.0.100 is not affected by CVE-2017-12615. The vulnerable FileDirContext class from Tomcat 7 does not exist in Tomcat 9. The entire resource handling architecture was refactored in Tomcat 8.0+ to use WebResourceRoot with mandatory path validation. All file write operations go through StandardRoot.write() which calls validate() to normalize paths and prevent traversal. The RequestUtil.normalize() method returns null for paths attempting to escape the root, causing validation to throw exceptions. There is no code path from HTTP PUT requests to writing files outside the document root.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 9.0.100 is not affected by CVE-2017-12617. The vulnerability, which allowed JSP file uploads via specially crafted PUT requests with trailing slashes, was fixed in upstream Apache Tomcat 9.0.0 (September 2017) by Mark Thomas. Both required fixes\u2014DirResourceSet.write() validation (commit b7e0435d17) and AbstractFileResourceSet.file() validation (commit b577f9a799)\u2014are present in the target repository. These fixes were included in the upstream release that TuxCare onboarded for version 9.0.100, predating all TuxCare maintenance commits. The vulnerable code pattern no longer exists in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12617" }, "impact_statement": "The target Apache Tomcat 9.0.100 is not affected by CVE-2017-12617. The vulnerability, which allowed JSP file uploads via specially crafted PUT requests with trailing slashes, was fixed in upstream Apache Tomcat 9.0.0 (September 2017) by Mark Thomas. Both required fixes\u2014DirResourceSet.write() validation (commit b7e0435d17) and AbstractFileResourceSet.file() validation (commit b577f9a799)\u2014are present in the target repository. These fixes were included in the upstream release that TuxCare onboarded for version 9.0.100, predating all TuxCare maintenance commits. The vulnerable code pattern no longer exists in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Tomcat 9.0.100. The vulnerability involved passing internal Request/Response objects directly to application listeners instead of using facade wrappers, allowing untrusted applications under SecurityManager to retain references and access cross-application data. The fix (using request.getRequest() to pass facades) was introduced by upstream commit dfa40863421d7681fed893b4256666491887e38c in March 2017 and was already present in the Apache Tomcat 9.0.100 upstream release when TuxCare onboarded it. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use the facade pattern at lines 456/458/496/498, 113, and 116/172 respectively.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5648" }, "impact_statement": "CVE-2017-5648 is NOT present in Tomcat 9.0.100. The vulnerability involved passing internal Request/Response objects directly to application listeners instead of using facade wrappers, allowing untrusted applications under SecurityManager to retain references and access cross-application data. The fix (using request.getRequest() to pass facades) was introduced by upstream commit dfa40863421d7681fed893b4256666491887e38c in March 2017 and was already present in the Apache Tomcat 9.0.100 upstream release when TuxCare onboarded it. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use the facade pattern at lines 456/458/496/498, 113, and 116/172 respectively.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 affected Apache Tomcat 9.0.0.M1 to 9.0.0.M18. The target is Tomcat 9.0.100, which already contains the upstream fix applied by Mark Thomas on March 24, 2017. The fix was shipped in the upstream Apache Tomcat 9.0.100 release (tagged Feb 13, 2025) before TuxCare onboarding. All fix patterns are present: SendfileState tracking (line 262), modified while loop condition (line 265), processSendfile() method (line 1420), and no sendfileData clearing in prepareRequest(). The vulnerable pattern (premature Processor recycling during fast sendfile completion) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5651" }, "impact_statement": "CVE-2017-5651 affected Apache Tomcat 9.0.0.M1 to 9.0.0.M18. The target is Tomcat 9.0.100, which already contains the upstream fix applied by Mark Thomas on March 24, 2017. The fix was shipped in the upstream Apache Tomcat 9.0.100 release (tagged Feb 13, 2025) before TuxCare onboarding. All fix patterns are present: SendfileState tracking (line 262), modified while loop condition (line 265), processSendfile() method (line 1420), and no sendfileData clearing in prepareRequest(). The vulnerable pattern (premature Processor recycling during fast sendfile completion) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is not present in Apache Tomcat 9.0.100. The vulnerability involves the DefaultServlet's directory redirect behavior that could be exploited to generate protocol-relative redirects to attacker-controlled URLs. The fix (removing extra leading slashes from redirect locations) is already present in the target code at DefaultServlet.java:1377-1380. This fix was authored by the upstre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11784" }, "impact_statement": "not_affected \u2014 CVE-2018-11784 is not present in Apache Tomcat 9.0.100. The vulnerability involves the DefaultServlet's directory redirect behavior that could be exploited to generate protocol-relative redirects to attacker-controlled URLs. The fix (removing extra leading slashes from redirect locations) is already present in the target code at DefaultServlet.java:1377-1380. This fix was authored by the upstre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-02T14:32:23.288736+00:00", "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is not present in Tomcat 9.0.100. The vulnerability involved empty string URL patterns (\"\") in security constraints not being correctly matched to the context root (\"/\"), allowing unauthorized access. The fix (commit 723ea6a5bc by Mark Thomas, Feb 6 2018) adds special case handling: normalizing empty URIs to \"/\" and matching empty patterns to \"/\". This upstream fix shipped with To...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1304" }, "impact_statement": "not_affected \u2014 CVE-2018-1304 is not present in Tomcat 9.0.100. The vulnerability involved empty string URL patterns (\"\") in security constraints not being correctly matched to the context root (\"/\"), allowing unauthorized access. The fix (commit 723ea6a5bc by Mark Thomas, Feb 6 2018) adds special case handling: normalizing empty URIs to \"/\" and matching empty patterns to \"/\". This upstream fix shipped with To..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Tomcat 9.0.100 is not affected by CVE-2018-1305. The vulnerability was fixed in upstream Apache Tomcat on 2018-02-06 (commit 3e54b2a631) by Mark Thomas, which shipped with the Tomcat 9.0.100 release before TuxCare onboarded it. The fix moved ServletSecurity annotation processing from lazy servlet-load time to web application startup time, ensuring security constraints are applied consist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1305" }, "impact_statement": "not_affected \u2014 Target Tomcat 9.0.100 is not affected by CVE-2018-1305. The vulnerability was fixed in upstream Apache Tomcat on 2018-02-06 (commit 3e54b2a631) by Mark Thomas, which shipped with the Tomcat 9.0.100 release before TuxCare onboarded it. The fix moved ServletSecurity annotation processing from lazy servlet-load time to web application startup time, ensuring security constraints are applied consist..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The target (Tomcat 9.0.100) is NOT AFFECTED by CVE-2018-1336. The vulnerability involved an infinite loop in the UTF-8 decoder when processing 4-byte supplementary characters due to improper position management on buffer overflow. The fix was applied by upstream Apache Tomcat in commit 92cd494555 (April 2018) and was included in the upstream 9.0.100 release that TuxCare onboarded. The vulnerable code pattern (missing position rewind before returning OVERFLOW) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1336" }, "impact_statement": "The target (Tomcat 9.0.100) is NOT AFFECTED by CVE-2018-1336. The vulnerability involved an infinite loop in the UTF-8 decoder when processing 4-byte supplementary characters due to improper position management on buffer overflow. The fix was applied by upstream Apache Tomcat in commit 92cd494555 (April 2018) and was included in the upstream 9.0.100 release that TuxCare onboarded. The vulnerable code pattern (missing position rewind before returning OVERFLOW) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 9.0.100) is NOT affected by CVE-2018-8014. The vulnerability concerns insecure default CORS filter settings that enable credentials for all origins. The upstream fix (commit d83a76732e by Mark Thomas on 2018-05-16) was already included in the Apache Tomcat 9.0.100 release that TuxCare onboarded. All four components of the fix are present: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing the insecure combination, and corrected header logic. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8014" }, "impact_statement": "The target repository (Apache Tomcat 9.0.100) is NOT affected by CVE-2018-8014. The vulnerability concerns insecure default CORS filter settings that enable credentials for all origins. The upstream fix (commit d83a76732e by Mark Thomas on 2018-05-16) was already included in the Apache Tomcat 9.0.100 release that TuxCare onboarded. All four components of the fix are present: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing the insecure combination, and corrected header logic. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034: The target Apache Tomcat 9.0.100 is NOT AFFECTED. The vulnerability (missing hostname verification in WebSocket TLS client connections) has been fixed by upstream Apache commit 2835bb4e03 (author: Mark Thomas). This fix was already present in the upstream release 9.0.100 before TuxCare onboarded it. Hostname verification is enabled by default via setEndpointIdentificationAlgorithm(\"HTTPS\") at lines 946-952 of WsWebSocketContainer.java and cannot be disabled through normal configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8034" }, "impact_statement": "CVE-2018-8034: The target Apache Tomcat 9.0.100 is NOT AFFECTED. The vulnerability (missing hostname verification in WebSocket TLS client connections) has been fixed by upstream Apache commit 2835bb4e03 (author: Mark Thomas). This fix was already present in the upstream release 9.0.100 before TuxCare onboarded it. Hostname verification is enabled by default via setEndpointIdentificationAlgorithm(\"HTTPS\") at lines 946-952 of WsWebSocketContainer.java and cannot be disabled through normal configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T01:26:39.724365+00:00", "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Tomcat 9.0.100 is not affected by CVE-2018-8037. Both parts of the vulnerability fix (generation-based async timeout tracking and connection closure tracking for NIO/NIO2 connectors) were already present in upstream release 9.0.100 when TuxCare onboarded it on 2025-12-18. The fixes were authored by Apache developers Mark Thomas (markt@apache.org) and R\u00e9my Maucherat (remm@apache.org), not...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8037" }, "impact_statement": "not_affected \u2014 Target Tomcat 9.0.100 is not affected by CVE-2018-8037. Both parts of the vulnerability fix (generation-based async timeout tracking and connection closure tracking for NIO/NIO2 connectors) were already present in upstream release 9.0.100 when TuxCare onboarded it on 2025-12-18. The fixes were authored by Apache developers Mark Thomas (markt@apache.org) and R\u00e9my Maucherat (remm@apache.org), not..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 describes a DoS vulnerability in Apache Tomcat's HTTP/2 implementation (versions 9.0.0.M1-9.0.14 and 8.5.0-8.5.37) where excessive SETTINGS frames and indefinitely blocking streams can exhaust server threads. The target (Tomcat 9.0.100-tuxcare.6) is NOT AFFECTED because all three upstream mitigations are present: (1) stream read timeouts (20s default), (2) stream write timeouts (20s default), and (3) overhead frame tracking that closes connections sending excessive non-data frames. These fixes were committed by Apache upstream (Mark Thomas) on 2019-02-01, included in Tomcat 9.0.15 (March 2019), and were already present in 9.0.100 when TuxCare onboarded it in December 2025. The vulnerable code pattern does not exist in the target because the upstream release already contained the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0199" }, "impact_statement": "CVE-2019-0199 describes a DoS vulnerability in Apache Tomcat's HTTP/2 implementation (versions 9.0.0.M1-9.0.14 and 8.5.0-8.5.37) where excessive SETTINGS frames and indefinitely blocking streams can exhaust server threads. The target (Tomcat 9.0.100-tuxcare.6) is NOT AFFECTED because all three upstream mitigations are present: (1) stream read timeouts (20s default), (2) stream write timeouts (20s default), and (3) overhead frame tracking that closes connections sending excessive non-data frames. These fixes were committed by Apache upstream (Mark Thomas) on 2019-02-01, included in Tomcat 9.0.15 (March 2019), and were already present in 9.0.100 when TuxCare onboarded it in December 2025. The vulnerable code pattern does not exist in the target because the upstream release already contained the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Apache Tomcat 9.0.100-tuxcare.6 already contains the upstream fix (commit 15fcd166ea) that adds HTML entity encoding to variable output via the ENCODING_ENTITY parameter. This fix was authored by Mark Thomas (markt@apache.org) and was already present in the upstream Apache...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0221" }, "impact_statement": "not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Apache Tomcat 9.0.100-tuxcare.6 already contains the upstream fix (commit 15fcd166ea) that adds HTML entity encoding to variable output via the ENCODING_ENTITY parameter. This fix was authored by Mark Thomas (markt@apache.org) and was already present in the upstream Apache..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 9.0.100 is not vulnerable to CVE-2019-0232. The vulnerability affects the CGI servlet when enableCmdLineArguments is enabled on Windows, allowing RCE via command injection through crafted query parameters. The upstream fix adds validation of decoded command line arguments against a restrictive pattern ([\\\\w\\\\Q-.\\\\/:\\\\E]+ on Windows) to block shell metacharacters. This fix was authored by Mark Thomas (markt@apache.org) in commit 4b244d827a and was already present in the Apache Tomcat 9.0.100 upstream release that TuxCare onboarded. The vulnerable code pattern is not present in HEAD because the upstream vendor removed it before the 9.0.100 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-0232" }, "impact_statement": "Target Tomcat 9.0.100 is not vulnerable to CVE-2019-0232. The vulnerability affects the CGI servlet when enableCmdLineArguments is enabled on Windows, allowing RCE via command injection through crafted query parameters. The upstream fix adds validation of decoded command line arguments against a restrictive pattern ([\\\\w\\\\Q-.\\\\/:\\\\E]+ on Windows) to block shell metacharacters. This fix was authored by Mark Thomas (markt@apache.org) in commit 4b244d827a and was already present in the Apache Tomcat 9.0.100 upstream release that TuxCare onboarded. The vulnerable code pattern is not present in HEAD because the upstream vendor removed it before the 9.0.100 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 9.0.100 is NOT affected by CVE-2019-10072. The vulnerability (HTTP/2 connection window exhaustion causing thread exhaustion via indefinite blocking) was fixed by upstream Apache Tomcat in commits 7f748eb6bf (Apr 30, 2019) and ada725a50a (May 3, 2019), authored by Mark Thomas (markt@apache.org). These commits added timeout handling to connection window allocation waits, ensuring threads don't block indefinitely when clients withhold WINDOW_UPDATE messages. The fix was already present in the Apache Tomcat 9.0.100 release before TuxCare set it up (first TuxCare commit: 962333f6197, Dec 18, 2025). The defense is active by default with a 5-second write timeout (DEFAULT_WRITE_TIMEOUT = 5000ms). The vulnerable pattern (indefinite blocking) is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10072" }, "impact_statement": "The target Apache Tomcat 9.0.100 is NOT affected by CVE-2019-10072. The vulnerability (HTTP/2 connection window exhaustion causing thread exhaustion via indefinite blocking) was fixed by upstream Apache Tomcat in commits 7f748eb6bf (Apr 30, 2019) and ada725a50a (May 3, 2019), authored by Mark Thomas (markt@apache.org). These commits added timeout handling to connection window allocation waits, ensuring threads don't block indefinitely when clients withhold WINDOW_UPDATE messages. The fix was already present in the Apache Tomcat 9.0.100 release before TuxCare set it up (first TuxCare commit: 962333f6197, Dec 18, 2025). The defense is active by default with a 5-second write timeout (DEFAULT_WRITE_TIMEOUT = 5000ms). The vulnerable pattern (indefinite blocking) is not present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.100 is NOT AFFECTED by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) does not exist in this version. The component was removed by upstream Apache developers in version ~9.0.58 (January 2022), approximately 3 years before version 9.0.100 was released (February 2025). Exhaustive searches for the class, RMI registry creation patterns, and JMX remote connector code found no matches. The upstream changelog at Tag 9.0.100 confirms: \"Remove the deprecated JmxRemoteLifecycleListener. (markt)\". When TuxCare onboarded 9.0.100, the file had already been absent for years. This is a Type A1 case under Rule 5: the Input type (RMI registry manipulation operations within JmxRemoteLifecycleListener) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12418" }, "impact_statement": "Apache Tomcat 9.0.100 is NOT AFFECTED by CVE-2019-12418. The vulnerable component (JmxRemoteLifecycleListener) does not exist in this version. The component was removed by upstream Apache developers in version ~9.0.58 (January 2022), approximately 3 years before version 9.0.100 was released (February 2025). Exhaustive searches for the class, RMI registry creation patterns, and JMX remote connector code found no matches. The upstream changelog at Tag 9.0.100 confirms: \"Remove the deprecated JmxRemoteLifecycleListener. (markt)\". When TuxCare onboarded 9.0.100, the file had already been absent for years. This is a Type A1 case under Rule 5: the Input type (RMI registry manipulation operations within JmxRemoteLifecycleListener) is not received anywhere in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 session fixation vulnerability is NOT present in target version 9.0.100. The upstream Apache Tomcat fix (commit 1ecba14e690cf5 by Mark Thomas, dated 2019-12-06) shipped in the upstream release before TuxCare maintenance began (2025-08-20). All three key fix patterns are present: (1) checkForCachedAuthentication() moved after matchRequest() check, (2) FORM_PRINCIPAL_NOTE constant deprecated and unused, (3) matchRequest() uses session.getPrincipal()/request.getPrincipal() instead of FORM_PRINCIPAL_NOTE. The timing window that allowed session fixation attacks during FORM authentication has been eliminated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17563" }, "impact_statement": "CVE-2019-17563 session fixation vulnerability is NOT present in target version 9.0.100. The upstream Apache Tomcat fix (commit 1ecba14e690cf5 by Mark Thomas, dated 2019-12-06) shipped in the upstream release before TuxCare maintenance began (2025-08-20). All three key fix patterns are present: (1) checkForCachedAuthentication() moved after matchRequest() check, (2) FORM_PRINCIPAL_NOTE constant deprecated and unused, (3) matchRequest() uses session.getPrincipal()/request.getPrincipal() instead of FORM_PRINCIPAL_NOTE. The timing window that allowed session fixation attacks during FORM authentication has been eliminated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T16:27:00.867186+00:00", "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28 to 9.0.30. Target version 9.0.100 is not affected because the fix for invalid Transfer-Encoding header validation was already present in the upstream Apache Tomcat 9.0.100 release. The vulnerable code pattern (accepting invalid Transfer-Encoding headers without validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17569" }, "impact_statement": "not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28 to 9.0.30. Target version 9.0.100 is not affected because the fix for invalid Transfer-Encoding header validation was already present in the upstream Apache Tomcat 9.0.100 release. The vulnerable code pattern (accepting invalid Transfer-Encoding headers without validation) is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935: Apache Tomcat 9.0.100 is NOT AFFECTED. The vulnerability (improper HTTP header CRLF parsing allowing invalid headers to be accepted) was fixed by Apache upstream in commit 8bfb0ff7 authored by markt@apache.org on 2020-01-06. This fix shipped in the Apache Tomcat 9.0.100 release before TuxCare onboarded the version. All defense components are present in the target code: prevChr tr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-1935" }, "impact_statement": "not_affected \u2014 CVE-2020-1935: Apache Tomcat 9.0.100 is NOT AFFECTED. The vulnerability (improper HTTP header CRLF parsing allowing invalid headers to be accepted) was fixed by Apache upstream in commit 8bfb0ff7 authored by markt@apache.org on 2020-01-06. This fix shipped in the Apache Tomcat 9.0.100 release before TuxCare onboarded the version. All defense components are present in the target code: prevChr tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) affects Apache Tomcat 9.0.0.M1 to 9.0.30. The target is version 9.0.100, which already contains all upstream security fixes from version 9.0.31 (released January 2020). All three defense layers are present: (1) AJP connector binds to loopback by default, (2) secret/secretRequired authentication is enforced, (3) arbitrary request attributes are blocked unless matching an allowed pattern. The AJP connector is also commented out by default in server.xml. The fixes were authored by markt@apache.org and shipped in the upstream 9.0.100 release before TuxCare onboarded it (first TuxCare commit: 962333f6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-1938" }, "impact_statement": "CVE-2020-1938 (Ghostcat) affects Apache Tomcat 9.0.0.M1 to 9.0.30. The target is version 9.0.100, which already contains all upstream security fixes from version 9.0.31 (released January 2020). All three defense layers are present: (1) AJP connector binds to loopback by default, (2) secret/secretRequired authentication is enforced, (3) arbitrary request attributes are blocked unless matching an allowed pattern. The AJP connector is also commented out by default in server.xml. The fixes were authored by markt@apache.org and shipped in the upstream 9.0.100 release before TuxCare onboarded it (first TuxCare commit: 962333f6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. already_fixed \u2014 CVE-2020-9484 TOCTOU vulnerability in FileStore session persistence has been fixed. The current code (commit 1385c624b4, January 2022) properly resolves the canonical file path once, validates it against the storage directory, and returns the canonical file object, eliminating the time-of-check-time-of-use window that allowed path traversal attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9484" }, "impact_statement": "already_fixed \u2014 CVE-2020-9484 TOCTOU vulnerability in FileStore session persistence has been fixed. The current code (commit 1385c624b4, January 2022) properly resolves the canonical file path once, validates it against the storage directory, and returns the canonical file object, eliminating the time-of-check-time-of-use window that allowed path traversal attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-24122 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2021-24122 is NOT present in Apache Tomcat 9.0.100. The vulnerability (JSP source code disclosure via path confusion using the `:` character on Windows NTFS) was fixed by upstream Apache in commit 935fc5582d (Nov 6, 2020) authored by Mark Thomas (markt@apache.org). This fix was already included in Tomcat 9.0.100 when TuxCare began maintaining this version. The fix adds validation in Abstrac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-24122" }, "impact_statement": "not_affected \u2014 CVE-2021-24122 is NOT present in Apache Tomcat 9.0.100. The vulnerability (JSP source code disclosure via path confusion using the `:` character on Windows NTFS) was fixed by upstream Apache in commit 935fc5582d (Nov 6, 2020) authored by Mark Thomas (markt@apache.org). This fix was already included in Tomcat 9.0.100 when TuxCare began maintaining this version. The fix adds validation in Abstrac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-25122 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 affects Apache Tomcat 9.0.0.M1 to 9.0.41 where h2c connection upgrades could leak request headers and body data between users. The vulnerability was caused by calling wrapper.unRead(leftOverInput) AFTER creating the new upgrade processor, allowing leftover data to be associated with the wrong connection. The target repository is Apache Tomcat 9.0.100, which already contains the upstream fix (commit d47c20a776) that moves wrapper.unRead() to BEFORE processor creation. This fix was shipped in the upstream Apache Tomcat 9.0.100 release and inherited by TuxCare when they onboarded the version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-25122" }, "impact_statement": "CVE-2021-25122 affects Apache Tomcat 9.0.0.M1 to 9.0.41 where h2c connection upgrades could leak request headers and body data between users. The vulnerability was caused by calling wrapper.unRead(leftOverInput) AFTER creating the new upgrade processor, allowing leftover data to be associated with the wrong connection. The target repository is Apache Tomcat 9.0.100, which already contains the upstream fix (commit d47c20a776) that moves wrapper.unRead() to BEFORE processor creation. This fix was shipped in the upstream Apache Tomcat 9.0.100 release and inherited by TuxCare when they onboarded the version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2021-25329 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25329 is not present in Tomcat 9.0.100. The vulnerability involved inadequate path validation using String.startsWith() for directory containment checks, which could allow path traversal attacks. The upstream fix (commit 4785433a22 by Mark Thomas, January 2021) replaced the vulnerable pattern with java.nio.file.Path-based validation across all affected files (DefaultServlet.java, FileStore.java, ExpandWar.java, ContextConfig.java, HostConfig.java). This fix was already included in the Apache Tomcat 9.0.100 upstream release before TuxCare onboarded it, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-25329" }, "impact_statement": "CVE-2021-25329 is not present in Tomcat 9.0.100. The vulnerability involved inadequate path validation using String.startsWith() for directory containment checks, which could allow path traversal attacks. The upstream fix (commit 4785433a22 by Mark Thomas, January 2021) replaced the vulnerable pattern with java.nio.file.Path-based validation across all affected files (DefaultServlet.java, FileStore.java, ExpandWar.java, ContextConfig.java, HostConfig.java). This fix was already included in the Apache Tomcat 9.0.100 upstream release before TuxCare onboarded it, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:42:00.511362+00:00", "status_notes": "Vulnerability CVE-2022-42252 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2022-42252 affects Apache Tomcat versions 9.0.0-M1 to 9.0.67. The target version 9.0.100 is beyond this range. The fix (commit 4c7f4fd09d) was released in Apache Tomcat 9.0.68 and was already present in the upstream 9.0.100 release that TuxCare onboarded. The vulnerable code pattern (silently accepting malformed Content-Length headers when rejectIllegalHeader=false) is not present in the target. The fix correctly forces rejection of any request with a malformed Content-Length header, preventing HTTP request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42252" }, "impact_statement": "CVE-2022-42252 affects Apache Tomcat versions 9.0.0-M1 to 9.0.67. The target version 9.0.100 is beyond this range. The fix (commit 4c7f4fd09d) was released in Apache Tomcat 9.0.68 and was already present in the upstream 9.0.100 release that TuxCare onboarded. The vulnerable code pattern (silently accepting malformed Content-Length headers when rejectIllegalHeader=false) is not present in the target. The fix correctly forces rejection of any request with a malformed Content-Length header, preventing HTTP request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45143 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2022-45143" }, "action_statement": "Vulnerability CVE-2022-45143 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:41:21.668205+00:00", "status_notes": "Vulnerability CVE-2023-24998 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-24998 fix was already present in Apache Tomcat 9.0.100 upstream release. The vulnerability (unbounded multipart request part processing leading to DoS) is not present because commit cf77cc545de by Mark Thomas (Apache) added fileCountMax limiting in December 2022, prior to the 9.0.100 release. Target includes: FileUploadBase.fileCountMax field, setFileCountMax()/getFileCountMax() methods, enforcement check throwing FileCountLimitExceededException when items.size()==fileCountMax, and Request.java calling upload.setFileCountMax(partLimit) with default limit of 10000. The fix is upstream-authored, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-24998" }, "impact_statement": "CVE-2023-24998 fix was already present in Apache Tomcat 9.0.100 upstream release. The vulnerability (unbounded multipart request part processing leading to DoS) is not present because commit cf77cc545de by Mark Thomas (Apache) added fileCountMax limiting in December 2022, prior to the 9.0.100 release. Target includes: FileUploadBase.fileCountMax field, setFileCountMax()/getFileCountMax() methods, enforcement check throwing FileCountLimitExceededException when items.size()==fileCountMax, and Request.java calling upload.setFileCountMax(partLimit) with default limit of 10000. The fix is upstream-authored, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:18:58.233822+00:00", "status_notes": "Vulnerability CVE-2023-28709 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-28709 is NOT present in Tomcat 9.0.100. The vulnerability was an off-by-one error in Parameters.addParameter() that allowed bypassing maxParameterCount limits. The fix (commit fbd81421629afe8b8a3922d59020cde81caea861 by Apache's Mark Thomas) shipped in upstream release 9.0.74 and is present in 9.0.100. The target code at lines 204-210 of Parameters.java correctly checks `parameterCount >= limit` BEFORE incrementing, preventing the bypass. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-28709" }, "impact_statement": "CVE-2023-28709 is NOT present in Tomcat 9.0.100. The vulnerability was an off-by-one error in Parameters.addParameter() that allowed bypassing maxParameterCount limits. The fix (commit fbd81421629afe8b8a3922d59020cde81caea861 by Apache's Mark Thomas) shipped in upstream release 9.0.74 and is present in 9.0.100. The target code at lines 204-210 of Parameters.java correctly checks `parameterCount >= limit` BEFORE incrementing, preventing the bypass. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:20:30.171913+00:00", "status_notes": "Vulnerability CVE-2023-34981 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-34981 is NOT present in Apache Tomcat 9.0.100. The vulnerability was a regression in bug 66512's fix where responses with no HTTP headers would not send the AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests. The fix (commit 2f0ca23784) was already present in the upstream Apache Tomcat 9.0.100 release before TuxCare onboarded it. The current code uses a `while (needAjpMessageHeader)` loop that ensures SEND_HEADERS is always sent, even when numHeaders == 0, preventing the information leak.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34981" }, "impact_statement": "CVE-2023-34981 is NOT present in Apache Tomcat 9.0.100. The vulnerability was a regression in bug 66512's fix where responses with no HTTP headers would not send the AJP SEND_HEADERS message, causing mod_proxy_ajp to reuse headers from previous requests. The fix (commit 2f0ca23784) was already present in the upstream Apache Tomcat 9.0.100 release before TuxCare onboarded it. The current code uses a `while (needAjpMessageHeader)` loop that ensures SEND_HEADERS is always sent, even when numHeaders == 0, preventing the information leak.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-10-30T00:50:04.588656+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) does NOT affect Tomcat 9.0.100. The upstream fix by Mark Thomas (markt@apache.org, commit 77c0ce2d1..., August 22, 2023) was already present in Apache Tomcat 9.0.100 before TuxCare onboarded it. The fix strips extra leading slashes from redirect URLs in FormAuthenticator.savedRequestURL() (lines 766-769), preventing protocol-relative URL red...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) does NOT affect Tomcat 9.0.100. The upstream fix by Mark Thomas (markt@apache.org, commit 77c0ce2d1..., August 22, 2023) was already present in Apache Tomcat 9.0.100 before TuxCare onboarded it. The fix strips extra leading slashes from redirect URLs in FormAuthenticator.savedRequestURL() (lines 766-769), preventing protocol-relative URL red..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:39:32.418284+00:00", "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.100 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream Apache Tomcat project fixed this vulnerability in commit 6d1a9fd6642387969e4410b9989c85856b74917a by Mark Thomas on October 5, 2023. This fix was included in the Apache Tomcat 9.0.100 upstream release that TuxCare onboarded. The fix adds overhead tracking for RST_STREAM frames (with a higher weight factor of 50x) and PRIORITY_UPDATE frames, and stops processing when the overhead limit is exceeded, effectively preventing rapid reset attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-44487" }, "impact_statement": "Apache Tomcat 9.0.100 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream Apache Tomcat project fixed this vulnerability in commit 6d1a9fd6642387969e4410b9989c85856b74917a by Mark Thomas on October 5, 2023. This fix was included in the Apache Tomcat 9.0.100 upstream release that TuxCare onboarded. The fix adds overhead tracking for RST_STREAM frames (with a higher weight factor of 50x) and PRIORITY_UPDATE frames, and stops processing when the overhead limit is exceeded, effectively preventing rapid reset attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-45648 is not present in Tomcat 9.0.100. The vulnerability (improper parsing of HTTP trailer headers in chunked transfer encoding requests, enabling request smuggling) was fixed in upstream Apache Tomcat through architectural refactoring that introduced the HttpHeaderParser class with proper validation of trailer header names and values. This upstream fix was already present in the 9.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 CVE-2023-45648 is not present in Tomcat 9.0.100. The vulnerability (improper parsing of HTTP trailer headers in chunked transfer encoding requests, enabling request smuggling) was fixed in upstream Apache Tomcat through architectural refactoring that introduced the HttpHeaderParser class with proper validation of trailer header names and values. This upstream fix was already present in the 9.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:40:00.069704+00:00", "status_notes": "Vulnerability CVE-2023-46589 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-46589 is not affecting Apache Tomcat 9.0.100. The vulnerability (improper HTTP trailer header parsing enabling request smuggling) was fixed in the upstream release through a refactoring that introduced HttpHeaderParser with proper validation. The fix validates trailer header names using HttpParser.isToken() and rejects control characters in values using HttpParser.isControl(), matching the CVE-2023-46589 mitigation. This fix was authored by upstream Apache developer Mark Thomas (markt@apache.org) on April 26, 2024 and was already present when TuxCare onboarded version 9.0.100 on December 18, 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-46589" }, "impact_statement": "CVE-2023-46589 is not affecting Apache Tomcat 9.0.100. The vulnerability (improper HTTP trailer header parsing enabling request smuggling) was fixed in the upstream release through a refactoring that introduced HttpHeaderParser with proper validation. The fix validates trailer header names using HttpParser.isToken() and rejects control characters in values using HttpParser.isControl(), matching the CVE-2023-46589 mitigation. This fix was authored by upstream Apache developer Mark Thomas (markt@apache.org) on April 26, 2024 and was already present when TuxCare onboarded version 9.0.100 on December 18, 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-02T18:44:00.098481+00:00", "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.100 is not affected by CVE-2024-21733. The vulnerability affects Tomcat 9.0.0-M11 through 9.0.43, with the fix available in 9.0.44+. The upstream Apache Tomcat 9.0.100 release already contained the fix (commit d1da266aa1ea541b9f7a356bce9c2cc332658078 by markt@apache.org on 2021-02-25), which was onboarded by TuxCare on 2025-12-18. The target has two IS_IO_ALLOWED checks preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21733" }, "impact_statement": "not_affected \u2014 Target version 9.0.100 is not affected by CVE-2024-21733. The vulnerability affects Tomcat 9.0.0-M11 through 9.0.43, with the fix available in 9.0.44+. The upstream Apache Tomcat 9.0.100 release already contained the fix (commit d1da266aa1ea541b9f7a356bce9c2cc332658078 by markt@apache.org on 2021-02-25), which was onboarded by TuxCare on 2025-12-18. The target has two IS_IO_ALLOWED checks preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24549 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-24549 affects Tomcat 9.0.x up to 9.0.82; fixed in 9.0.83+. Target 9.0.100 already contains the fix, so this version is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24549" }, "impact_statement": "CVE-2024-24549 affects Tomcat 9.0.x up to 9.0.82; fixed in 9.0.83+. Target 9.0.100 already contains the fix, so this version is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:39:32.418284+00:00", "status_notes": "Vulnerability CVE-2024-34750 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-34750 is NOT present in Tomcat 9.0.100. The upstream fix commit 9fec9a82887853402833a80b584e3762c7423f5f by Mark Thomas (markt@apache.org) was already present in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The fix adds atomic per-stream protection against double-decrementing the active stream count, preventing the miscounting that led to incorrect infinite timeouts. All defensive mechanisms are in place: the AtomicBoolean removedFromActiveCount flag in Stream.java (line 97), the decrementAndGetActiveRemoteStreamCount() method with compareAndSet protection (lines 949-959), proper increment at stream creation (Http2UpgradeHandler.java line 1632), and the corrected headersEnd validation logic (line 1701). The vulnerable pattern described in the CVE does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-34750" }, "impact_statement": "CVE-2024-34750 is NOT present in Tomcat 9.0.100. The upstream fix commit 9fec9a82887853402833a80b584e3762c7423f5f by Mark Thomas (markt@apache.org) was already present in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The fix adds atomic per-stream protection against double-decrementing the active stream count, preventing the miscounting that led to incorrect infinite timeouts. All defensive mechanisms are in place: the AtomicBoolean removedFromActiveCount flag in Stream.java (line 97), the decrementAndGetActiveRemoteStreamCount() method with compareAndSet protection (lines 949-959), proper increment at stream creation (Http2UpgradeHandler.java line 1632), and the corrected headersEnd validation logic (line 1701). The vulnerable pattern described in the CVE does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.0-M1, < 9.0.90; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.90; >= 10.1.0, < 10.1.25; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.0-M1, <= 9.0.89; >= 8.5.0, <= 8.5.100; >= 9.0.0-m1, <= 9.0.89; >= 10.1.0-m1, <= 10.1.24; >= 11.0.0-m1, <= 11.0.0-m20), Snyk (< 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:39:32.418284+00:00", "status_notes": "Vulnerability CVE-2024-38286 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-38286 (TLS handshake re-keying OOM vulnerability) is NOT present in Tomcat 9.0.100. The upstream Apache fix (commit 76c5cce6f0 by Mark Thomas) was already included in the Apache Tomcat 9.0.90 release and all subsequent versions including 9.0.100. The fix adds queue length limits (cap at 100 for NIO2, pending-wrap detection for NIO) to prevent unbounded accumulation of handshake wrap operations during TLS 1.3 client-initiated re-keying. The target contains the complete fix: SecureNio2Channel.java implements handshakeWrapQueueLength counter with HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT=100; SecureNioChannel.java implements needHandshakeWrap flag; both reset on wrap() and throw exceptions on overflow. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38286" }, "impact_statement": "CVE-2024-38286 (TLS handshake re-keying OOM vulnerability) is NOT present in Tomcat 9.0.100. The upstream Apache fix (commit 76c5cce6f0 by Mark Thomas) was already included in the Apache Tomcat 9.0.90 release and all subsequent versions including 9.0.100. The fix adds queue length limits (cap at 100 for NIO2, pending-wrap detection for NIO) to prevent unbounded accumulation of handshake wrap operations during TLS 1.3 client-initiated re-keying. The target contains the complete fix: SecureNio2Channel.java implements handshakeWrapQueueLength counter with HANDSHAKE_WRAP_QUEUE_LENGTH_LIMIT=100; SecureNioChannel.java implements needHandshakeWrap flag; both reset on wrap() and throw exceptions on overflow. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109), NVD (>= 9.0.13, < 9.0.90; >= 10.1.1, < 10.1.25; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M20; >= 10.1.0-M1, <= 10.1.24; >= 9.0.13, <= 9.0.89; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109; >= 11.0.0-m1, <= 11.0.0-m20; >= 10.1.0-m1, <= 10.1.24; >= 9.0.13, <= 9.0.89), Snyk (>= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21; >= 9.0.13, < 9.0.90; >= 10.1.0-M1, < 10.1.25; >= 11.0.0-M1, < 11.0.0-M21)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:39:13.268056+00:00", "status_notes": "Vulnerability CVE-2024-50379 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-50379 fix was already present in the upstream Apache Tomcat 9.0.100 release. The vulnerability pattern (unsynchronized file resource metadata operations leading to TOCTOU race conditions) is not present in the target because the complete fix, including ReentrantReadWriteLock-based synchronization, case-insensitive filesystem detection, and proper lock management, was authored by Mark Thomas (markt@apache.org) and shipped in upstream 9.0.100 before TuxCare onboarding. All fix components verified: WebResourceLockSet interface, DirResourceSet locking implementation, case-sensitivity detection, getLockKey normalization, locks in getResource/write/delete methods, and proper lock map storage (including follow-up fix from commit 684247ae).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50379" }, "impact_statement": "CVE-2024-50379 fix was already present in the upstream Apache Tomcat 9.0.100 release. The vulnerability pattern (unsynchronized file resource metadata operations leading to TOCTOU race conditions) is not present in the target because the complete fix, including ReentrantReadWriteLock-based synchronization, case-insensitive filesystem detection, and proper lock management, was authored by Mark Thomas (markt@apache.org) and shipped in upstream 9.0.100 before TuxCare onboarding. All fix components verified: WebResourceLockSet interface, DirResourceSet locking implementation, case-sensitivity detection, getLockKey normalization, locks in getResource/write/delete methods, and proper lock map storage (including follow-up fix from commit 684247ae).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T16:34:22.136729+00:00", "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-52317 does not affect this version. The vulnerability involves incorrect recycling of HTTP/2 request/response objects that could lead to data mix-up between users. The fix (commit 47307ee27a) splits Stream.recycle() into replace() and recycle() methods with double-checked locking to ensure request/response objects are recycled exactly once. This upstream fix was already present in Apac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52317" }, "impact_statement": "not_affected \u2014 CVE-2024-52317 does not affect this version. The vulnerability involves incorrect recycling of HTTP/2 request/response objects that could lead to data mix-up between users. The fix (commit 47307ee27a) splits Stream.recycle() into replace() and recycle() methods with double-checked locking to ensure request/response objects are recycled exactly once. This upstream fix was already present in Apac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2024-56337 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2024-56337 is not present in Apache Tomcat 9.0.100. The vulnerability concerns a TOCTOU race condition on case-insensitive file systems when the Java canonical file name cache (sun.io.useCanonCaches) is enabled, allowing path confusion attacks. The fix (commit 427732ef8ee7f707a32734a13a926a2d070b8ba9 by Mark Thomas @apache.org, dated 2025-01-16) was already included in the upstream Apache Tomcat 9.0.100 release. TuxCare onboarded this release via commit 962333f6 on 2025-01-16, inheriting the complete fix. The target repository at SHA cb0e44f1b4 contains all fix components: startup scripts setting -Dsun.io.useCanonCaches=false, runtime verification in DirResourceSet.initInternal() that prevents vulnerable configurations from starting, and JreCompat methods handling all Java versions. The implementation is fail-safe - if the canon cache cannot be disabled, it throws IllegalStateException to prevent startup. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56337" }, "impact_statement": "CVE-2024-56337 is not present in Apache Tomcat 9.0.100. The vulnerability concerns a TOCTOU race condition on case-insensitive file systems when the Java canonical file name cache (sun.io.useCanonCaches) is enabled, allowing path confusion attacks. The fix (commit 427732ef8ee7f707a32734a13a926a2d070b8ba9 by Mark Thomas @apache.org, dated 2025-01-16) was already included in the upstream Apache Tomcat 9.0.100 release. TuxCare onboarded this release via commit 962333f6 on 2025-01-16, inheriting the complete fix. The target repository at SHA cb0e44f1b4 contains all fix components: startup scripts setting -Dsun.io.useCanonCaches=false, runtime verification in DirResourceSet.initInternal() that prevents vulnerable configurations from starting, and JreCompat methods handling all Java versions. The implementation is fail-safe - if the canon cache cannot be disabled, it throws IllegalStateException to prevent startup. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98), NVD (>= 9.0.0, < 9.0.98; >= 10.1.0, < 10.1.34; >= 11.0.0, < 11.0.2), cve.org (>= 11.0.0-M1, <= 11.0.1; >= 10.1.0-M1, <= 10.1.33; >= 9.0.0.M1, <= 9.0.97; >= 8.5.0, <= 8.5.100), Snyk (>= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2; >= 8.5.0, < 9.0.98; >= 10.1.0-M1, < 10.1.34; >= 11.0.0-M1, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T11:40:00.069704+00:00", "status_notes": "Vulnerability CVE-2025-24813 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2025-24813 is NOT present in Apache Tomcat 9.0.100. The vulnerability involves predictable temporary file naming in the DefaultServlet's executePartialPut method, where the old code converted request paths to temp file names via path.replace('/', '.'), enabling path confusion attacks. The fix (using File.createTempFile with random names and immediate deletion) was already included in the upstream Apache Tomcat 9.0.100 release. CVE states affected versions are \"9.0.0.M1 through 9.0.98\" with fix in 9.0.99+. Target version 9.0.100 shipped with the fix from upstream (commit eb61aade8f by remm@apache.org), verified at the Setup commit 962333f619 when TuxCare onboarded this version. No TuxCare backport was needed for 9.0.100.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24813" }, "impact_statement": "CVE-2025-24813 is NOT present in Apache Tomcat 9.0.100. The vulnerability involves predictable temporary file naming in the DefaultServlet's executePartialPut method, where the old code converted request paths to temp file names via path.replace('/', '.'), enabling path confusion attacks. The fix (using File.createTempFile with random names and immediate deletion) was already included in the upstream Apache Tomcat 9.0.100 release. CVE states affected versions are \"9.0.0.M1 through 9.0.98\" with fix in 9.0.99+. Target version 9.0.100 shipped with the fix from upstream (commit eb61aade8f by remm@apache.org), verified at the Setup commit 962333f619 when TuxCare onboarded this version. No TuxCare backport was needed for 9.0.100.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 11.0.0-M1, < 11.0.3; >= 10.1.0-M1, < 10.1.35; >= 9.0.0.M1, < 9.0.99; >= 8.5.0, <= 8.5.100; >= 8.5.0, <= 8.5.100), NVD (< 9.0.99; >= 10.1.1, < 10.1.35; >= 11.0.1, < 11.0.3; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.2; >= 10.1.0-M1, <= 10.1.34; >= 9.0.0.M1, <= 9.0.98; >= 8.5.0, <= 8.5.100), Snyk (>= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3; >= 9.0.0.M1, < 9.0.99; >= 10.1.0-M1, < 10.1.35; >= 11.0.0-M1, < 11.0.3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31651" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-46701" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48988" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49124" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49125" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52520" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55668" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55752" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55754" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.6.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.6.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.4.", "vulnerability": { "name": "CVE-2026-25854" }, "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-03T16:32:27.596761+00:00", "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.100 is NOT AFFECTED by CVE-2026-29129. The vulnerability was introduced in upstream Tomcat on 2026-01-06 (commit 4ee45c5571) when TLS 1.3 cipher suite dual-list configuration support was added using HashSet, which loses insertion order. The bug was fixed on 2026-02-20 (commit 8d69b33764) by changing to LinkedHashSet. Version 9.0.100 predates this feature entirely - it never h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29129" }, "impact_statement": "not_affected \u2014 Target version 9.0.100 is NOT AFFECTED by CVE-2026-29129. The vulnerability was introduced in upstream Tomcat on 2026-01-06 (commit 4ee45c5571) when TLS 1.3 cipher suite dual-list configuration support was added using HashSet, which loses insertion order. The bug was fixed on 2026-02-20 (commit 8d69b33764) by changing to LinkedHashSet. Version 9.0.100 predates this feature entirely - it never h..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.5.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.100-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T16:52:53.138657+00:00", "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-53404" }, "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T16:48:00.070829+00:00", "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55276" }, "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T16:25:24.528819+00:00", "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55956" }, "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-11-04T16:31:00.070810+00:00", "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55957" }, "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.100-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.100-tuxcare.3" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.100-tuxcare.3.", "vulnerability": { "name": "GHSA-r53m-pfr5-7v87" }, "impact_statement": "The vulnerability has been withdrawn." } ] }