{ "@id": "urn:uuid:2b70339b-7d57-432d-b25b-87852dacfc1f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T12:23:00.127284+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 does not affect Tomcat 9.0.75-tuxcare.7. This XSS vulnerability in the host-manager application was fixed by Apache in June 2008, more than 10 years before the 9.0.13 upstream release (November 2018) that TuxCare onboarded. The target code includes comprehensive XSS defenses: all user-supplied input (hostname, aliases, messages) is HTML-encoded via Escape.htmlElementContent() befo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-1947" }, "impact_statement": "not_affected \u2014 CVE-2008-1947 does not affect Tomcat 9.0.75-tuxcare.7. This XSS vulnerability in the host-manager application was fixed by Apache in June 2008, more than 10 years before the 9.0.13 upstream release (November 2018) that TuxCare onboarded. The target code includes comprehensive XSS defenses: all user-supplied input (hostname, aliases, messages) is HTML-encoded via Escape.htmlElementContent() befo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.13 is not affected by CVE-2014-0095. The vulnerability (DoS via Content-Length: 0 AJP requests causing thread hang) was fixed by Apache upstream in March 2014. The fix was already present in the Apache Tomcat 9.0.13 release when TuxCare onboarded it. The current code at AjpProcessor.java:595-609 contains the defense logic that checks for contentLength == 0 and immediately retu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0095" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.13 is not affected by CVE-2014-0095. The vulnerability (DoS via Content-Length: 0 AJP requests causing thread hang) was fixed by Apache upstream in March 2014. The fix was already present in the Apache Tomcat 9.0.13 release when TuxCare onboarded it. The current code at AjpProcessor.java:595-609 contains the defense logic that checks for contentLength == 0 and immediately retu..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2017-12615 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2017-12615" }, "action_statement": "Vulnerability CVE-2017-12615 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.13 is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via specially crafted HTTP PUT requests when readonly was disabled, exploiting trailing-slash path confusion where the Java File API silently drops trailing slashes. The upstream fixes (commits b7e0435d17 and b577f9a799 by Mark Thomas) were already included in the Tomcat 9.0.13 release that TuxCare onboarded. Both defenses are present: DirResourceSet.write() rejects file creation paths ending in '/', and AbstractFileResourceSet.file() returns null when accessing files via paths ending in '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12617" }, "impact_statement": "Tomcat 9.0.13 is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via specially crafted HTTP PUT requests when readonly was disabled, exploiting trailing-slash path confusion where the Java File API silently drops trailing slashes. The upstream fixes (commits b7e0435d17 and b577f9a799 by Mark Thomas) were already included in the Tomcat 9.0.13 release that TuxCare onboarded. Both defenses are present: DirResourceSet.write() rejects file creation paths ending in '/', and AbstractFileResourceSet.file() returns null when accessing files via paths ending in '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.13 is not affected by CVE-2017-5648. The vulnerability was fixed in the upstream release before version 9.0.13. All calls to application listeners (fireRequestInitEvent/fireRequestDestroyEvent) use proper facade objects via request.getRequest(), preventing untrusted applications from retaining references to internal request/response objects and bypassing SecurityManager isolation. The fix commit (dfa40863421d7681fed893b4256666491887e38c) authored by markt@apache.org was already present in the upstream 9.0.13 release tag when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5648" }, "impact_statement": "Apache Tomcat 9.0.13 is not affected by CVE-2017-5648. The vulnerability was fixed in the upstream release before version 9.0.13. All calls to application listeners (fireRequestInitEvent/fireRequestDestroyEvent) use proper facade objects via request.getRequest(), preventing untrusted applications from retaining references to internal request/response objects and bypassing SecurityManager isolation. The fix commit (dfa40863421d7681fed893b4256666491887e38c) authored by markt@apache.org was already present in the upstream 9.0.13 release tag when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 9.0.13 is NOT AFFECTED by CVE-2017-5651. The upstream fix commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 by Mark Thomas (markt@apache.org) is present on HEAD and was already included in the upstream release 9.0.13 that TuxCare onboarded. The vulnerability pattern (Processor double-caching due to premature sendfileData clearing) does not exist in the target code. All defense mechanisms from the patch are verified present: SendfileState tracking prevents the Processor from being added to cache twice during sendfile operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5651" }, "impact_statement": "Target Apache Tomcat 9.0.13 is NOT AFFECTED by CVE-2017-5651. The upstream fix commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 by Mark Thomas (markt@apache.org) is present on HEAD and was already included in the upstream release 9.0.13 that TuxCare onboarded. The vulnerability pattern (Processor double-caching due to premature sendfileData clearing) does not exist in the target code. All defense mechanisms from the patch are verified present: SendfileState tracking prevents the Processor from being added to cache twice during sendfile operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 9.0.13 is NOT AFFECTED. The vulnerability pattern (unprotected directory redirect allowing protocol-relative URL exploitation) is not present because the upstream fix was already included in the 9.0.13 release. Apache commit efb860b3ff (author: Mark Thomas ) added sanitization to DefaultServlet.doDirectoryRedirect that strips multiple leading slashes from ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11784" }, "impact_statement": "not_affected \u2014 Target Apache Tomcat 9.0.13 is NOT AFFECTED. The vulnerability pattern (unprotected directory redirect allowing protocol-relative URL exploitation) is not present because the upstream fix was already included in the 9.0.13 release. Apache commit efb860b3ff (author: Mark Thomas ) added sanitization to DefaultServlet.doDirectoryRedirect that strips multiple leading slashes from ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 affects Tomcat 9.0.0.M1 to 9.0.4, where security constraints with URL pattern \"\" (empty string) were not correctly matched to the context root \"/\", allowing unauthorized access. The target is version 9.0.13, which already contains the upstream fix (commit 723ea6a5bc5 by Mark Thomas, applied 2018-02-06). The fix was shipped in the upstream release before TuxCare onboarded version 9...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1304" }, "impact_statement": "not_affected \u2014 CVE-2018-1304 affects Tomcat 9.0.0.M1 to 9.0.4, where security constraints with URL pattern \"\" (empty string) were not correctly matched to the context root \"/\", allowing unauthorized access. The target is version 9.0.13, which already contains the upstream fix (commit 723ea6a5bc5 by Mark Thomas, applied 2018-02-06). The fix was shipped in the upstream release before TuxCare onboarded version 9..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 9.0.13. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied lazily at servlet load time, allowing load-order-dependent bypass. The upstream fix (commit 3e54b2a631 by Mark Thomas, February 2018) moved annotation processing to web application startup, ensuring all constraints are applied before any requests. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1305" }, "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 9.0.13. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied lazily at servlet load time, allowing load-order-dependent bypass. The upstream fix (commit 3e54b2a631 by Mark Thomas, February 2018) moved annotation processing to web application startup, ensuring all constraints are applied before any requests. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 affects Apache Tomcat versions 9.0.0.M9 to 9.0.7. The target repository is version 9.0.13, which was released after the vulnerability was fixed upstream by Apache. The fix (commit 92cd494555 by markt@apache.org, dated April 27, 2018) adds position rewinding logic in Utf8Decoder.java when handling 4-byte UTF-8 sequences with insufficient output buffer space. This fix is present in the target code at lines 280-286, and analysis confirms it was included in the upstream 9.0.13 release before TuxCare onboarded this version. The vulnerable code pattern (missing position rewind before returning OVERFLOW) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1336" }, "impact_statement": "CVE-2018-1336 affects Apache Tomcat versions 9.0.0.M9 to 9.0.7. The target repository is version 9.0.13, which was released after the vulnerability was fixed upstream by Apache. The fix (commit 92cd494555 by markt@apache.org, dated April 27, 2018) adds position rewinding logic in Utf8Decoder.java when handling 4-byte UTF-8 sequences with insufficient output buffer space. This fix is present in the target code at lines 280-286, and analysis confirms it was included in the upstream 9.0.13 release before TuxCare onboarded this version. The vulnerable code pattern (missing position rewind before returning OVERFLOW) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 is NOT present in Apache Tomcat 9.0.13. The vulnerability concerned insecure default settings for the CORS filter (DEFAULT_ALLOWED_ORIGINS=\"*\" with DEFAULT_SUPPORTS_CREDENTIALS=\"true\"), which allowed any origin to make credentialed cross-origin requests. The fix was already present in the upstream Apache Tomcat 9.0.13 release that TuxCare onboarded. All three components of the fix are verified in the current code: (1) DEFAULT_ALLOWED_ORIGINS=\"\" at line 1086, (2) DEFAULT_SUPPORTS_CREDENTIALS=\"false\" at line 1102, and (3) validation preventing the insecure combination at lines 758-760. Fix authored by Mark Thomas (markt@apache.org) in commit d83a76732e, which predates the first TuxCare commit (deb49d19f6 \"Onboard version 9.0.13\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8014" }, "impact_statement": "CVE-2018-8014 is NOT present in Apache Tomcat 9.0.13. The vulnerability concerned insecure default settings for the CORS filter (DEFAULT_ALLOWED_ORIGINS=\"*\" with DEFAULT_SUPPORTS_CREDENTIALS=\"true\"), which allowed any origin to make credentialed cross-origin requests. The fix was already present in the upstream Apache Tomcat 9.0.13 release that TuxCare onboarded. All three components of the fix are verified in the current code: (1) DEFAULT_ALLOWED_ORIGINS=\"\" at line 1086, (2) DEFAULT_SUPPORTS_CREDENTIALS=\"false\" at line 1102, and (3) validation preventing the insecure combination at lines 758-760. Fix authored by Mark Thomas (markt@apache.org) in commit d83a76732e, which predates the first TuxCare commit (deb49d19f6 \"Onboard version 9.0.13\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 affects Apache Tomcat versions 9.0.0.M1 to 9.0.9 due to missing hostname verification in TLS WebSocket client connections. The target repository is Tomcat 9.0.13, which already includes the upstream fix (commit 2835bb4e03) authored by Mark Thomas (markt@apache.org). This fix was part of the upstream 9.0.13 release that TuxCare onboarded, not a TuxCare backport. The vulnerable code pattern is not present because the hostname verification defense is fully implemented in WsWebSocketContainer.java lines 942-948, where setEndpointIdentificationAlgorithm(\"HTTPS\") is configured on the SSLEngine.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8034" }, "impact_statement": "CVE-2018-8034 affects Apache Tomcat versions 9.0.0.M1 to 9.0.9 due to missing hostname verification in TLS WebSocket client connections. The target repository is Tomcat 9.0.13, which already includes the upstream fix (commit 2835bb4e03) authored by Mark Thomas (markt@apache.org). This fix was part of the upstream 9.0.13 release that TuxCare onboarded, not a TuxCare backport. The vulnerable code pattern is not present because the hostname verification defense is fully implemented in WsWebSocketContainer.java lines 942-948, where setEndpointIdentificationAlgorithm(\"HTTPS\") is configured on the SSLEngine.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target repository (Apache Tomcat 9.0.13) is NOT affected by CVE-2018-8037. The vulnerability affected versions 9.0.0.M9 to 9.0.9, and the fix was included in the upstream 9.0.10+ releases. The complete fix (generation tracking to prevent stale async timeout processing and improved connection closure tracking in NIO/NIO2 connectors) is present in the target codebase. This fix was authored by...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8037" }, "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 9.0.13) is NOT affected by CVE-2018-8037. The vulnerability affected versions 9.0.0.M9 to 9.0.9, and the fix was included in the upstream 9.0.10+ releases. The complete fix (generation tracking to prevent stale async timeout processing and improved connection closure tracking in NIO/NIO2 connectors) is present in the target codebase. This fix was authored by..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-0221 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-0221" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-0232 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-0232" }, "action_statement": "Vulnerability CVE-2019-0232 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-10072 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-10072" }, "action_statement": "Vulnerability CVE-2019-10072 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-12418 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-12418" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-17563 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-17563" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.13 is NOT affected by CVE-2019-17569. This version predates the regression that was introduced in version 9.0.28. The target uses a different, older implementation for parsing Transfer-Encoding headers that rejects invalid/unrecognized encodings with a 501 error, rather than silently ignoring them as the vulnerable versions (9.0.28-9.0.30) did. The vulnerable code pattern invo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17569" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.13 is NOT affected by CVE-2019-17569. This version predates the regression that was introduced in version 9.0.28. The target uses a different, older implementation for parsing Transfer-Encoding headers that rejects invalid/unrecognized encodings with a 501 error, rather than silently ignoring them as the vulnerable versions (9.0.28-9.0.30) did. The vulnerable code pattern invo..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2020-1938 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-1938" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2020-9484 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-9484" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2021-24122 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-24122" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2021-25329 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-25329" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2022-42252 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2022-42252" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.13 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that was introduced in Tomcat 9.0.40. Version 9.0.13 predates this introduction and does not contain the vulnerable class or any JSON error reporting functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "Apache Tomcat 9.0.13 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that was introduced in Tomcat 9.0.40. Version 9.0.13 predates this introduction and does not contain the vulnerable class or any JSON error reporting functionality." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2023-24998 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-24998" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2023-28709 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-28709" }, "action_statement": "Vulnerability CVE-2023-28709 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2023-34981 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-34981" }, "action_statement": "Vulnerability CVE-2023-34981 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-41080" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-42795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-44487" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-12T12:23:00.127284+00:00", "status_notes": "Vulnerability CVE-2023-45648 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.13-tuxcare.6.", "vulnerability": { "name": "CVE-2023-45648" }, "action_statement": "Vulnerability CVE-2023-45648 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.13-tuxcare.6." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:24:00.064871+00:00", "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-46589" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-24549" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-50379" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.13 does not contain the vulnerable request/response recycling mechanism that causes CVE-2024-52317. The vulnerability affects versions 9.0.92-9.0.95 where HTTP/2 request/response object recycling was introduced. Version 9.0.13 creates fresh Request and Response objects for each HTTP/2 stream with no recycling or pooling mechanism, making request/response mix-up impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52317" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.13 does not contain the vulnerable request/response recycling mechanism that causes CVE-2024-52317. The vulnerability affects versions 9.0.92-9.0.95 where HTTP/2 request/response object recycling was introduced. Version 9.0.13 creates fresh Request and Response objects for each HTTP/2 stream with no recycling or pooling mechanism, making request/response mix-up impossible." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-24813" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.13 is not affected by CVE-2025-31650. The vulnerability requires RFC 9218 Extensible Priorities implementation (PRIORITY_UPDATE frames and Priority header parsing via Priority.parsePriority() method), which does not exist in version 9.0.13. The target version only implements the original HTTP/2 PRIORITY frame mechanism (RFC 7540, frame type 2), which is unrelated to this CVE. Exhaustive code analysis confirmed zero RFC 9218-related code present: no PRIORITY_UPDATE frame type, no readPriorityUpdateFrame() method, no Priority.parsePriority() parser class, and no priority header case in Stream.emitHeader(). The CVE's affected version range starts at 9.0.76, where RFC 9218 support was introduced; version 9.0.13 predates this feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31650" }, "impact_statement": "Apache Tomcat 9.0.13 is not affected by CVE-2025-31650. The vulnerability requires RFC 9218 Extensible Priorities implementation (PRIORITY_UPDATE frames and Priority header parsing via Priority.parsePriority() method), which does not exist in version 9.0.13. The target version only implements the original HTTP/2 PRIORITY frame mechanism (RFC 7540, frame type 2), which is unrelated to this CVE. Exhaustive code analysis confirmed zero RFC 9218-related code present: no PRIORITY_UPDATE frame type, no readPriorityUpdateFrame() method, no Priority.parsePriority() parser class, and no priority header case in Stream.emitHeader(). The CVE's affected version range starts at 9.0.76, where RFC 9218 support was introduced; version 9.0.13 predates this feature." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-46701" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48988" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-06T17:24:00.046712+00:00", "status_notes": "Vulnerability CVE-2025-49124 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. Prechecker: The scan of this version produced no finding. The advisories list this line as affected from 9.0.23, and version 9.0.13 is older. Advisories: GitHub GHSA-42wg-hm62-jcwg (affected from 9.0.23), NVD (affected from 9.0.23), CVE record (affected from 9.0.23), Snyk (affected from 9.0.23).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49124" }, "impact_statement": "Prechecker: The scan of this version produced no finding. The advisories list this line as affected from 9.0.23, and version 9.0.13 is older. Advisories: GitHub GHSA-42wg-hm62-jcwg (affected from 9.0.23), NVD (affected from 9.0.23), CVE record (affected from 9.0.23), Snyk (affected from 9.0.23)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49125" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52520" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55668" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55752" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-25854" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2026-29129 affects Apache Tomcat versions with TLS 1.3 cipher suite configuration support, where a HashSet was used instead of LinkedHashSet in getJsseCipherNames(), causing the configured cipher preference order to be lost when combining TLS 1.3 and legacy cipher lists. Version 9.0.13 predates the TLS 1.3 cipher suite feature entirely (introduced in commit 4ee45c5571 on Jan 6, 2026) and us...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-29129" }, "impact_statement": "not_affected \u2014 CVE-2026-29129 affects Apache Tomcat versions with TLS 1.3 cipher suite configuration support, where a HashSet was used instead of LinkedHashSet in getJsseCipherNames(), causing the configured cipher preference order to be lost when combining TLS 1.3 and legacy cipher lists. Version 9.0.13 predates the TLS 1.3 cipher suite feature entirely (introduced in commit 4ee45c5571 on Jan 6, 2026) and us..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:24:00.064871+00:00", "status_notes": "Vulnerability CVE-2026-43512 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43512" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:24:00.064871+00:00", "status_notes": "Vulnerability CVE-2026-43515 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-53404" }, "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55276" }, "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55956" }, "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-55957" }, "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65905" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.13-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.13-tuxcare.5" } } ], "timestamp": "2026-11-05T07:23:37.836697+00:00", "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.13-tuxcare.5.", "vulnerability": { "name": "GHSA-r53m-pfr5-7v87" }, "impact_statement": "The vulnerability has been withdrawn." } ] }