{
  "@id": "urn:uuid:50987eef-ae12-4377-a760-3d3259aae4a4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:27.082072+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 affects Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16. The target version 9.0.39 is not affected because the upstream vendor (Apache Software Foundation) fixed this XSS vulnerability in 2008 and refactored the fix in 2017. The fix was already present in the upstream Tomcat 9.0.39 release that TuxCare onboarded. The vulnerable pattern (unescaped hostname output in HTML) is not presen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 affects Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16. The target version 9.0.39 is not affected because the upstream vendor (Apache Software Foundation) fixed this XSS vulnerability in 2008 and refactored the fix in 2017. The fix was already present in the upstream Tomcat 9.0.39 release that TuxCare onboarded. The vulnerable pattern (unescaped hostname output in HTML) is not presen..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 describes a denial of service vulnerability where AJP requests with Content-Length: 0 cause thread hangs. The target (Apache Tomcat 9.0.39) is NOT AFFECTED because the fix was already present in the upstream release. The fix, authored by Mark Thomas (markt@apache.org) in commit 13a80dba1f on 2014-11-23, explicitly handles Content-Length: 0 by immediately setting endOfStream=true a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 describes a denial of service vulnerability where AJP requests with Content-Length: 0 cause thread hangs. The target (Apache Tomcat 9.0.39) is NOT AFFECTED because the fix was already present in the upstream release. The fix, authored by Mark Thomas (markt@apache.org) in commit 13a80dba1f on 2014-11-23, explicitly handles Content-Length: 0 by immediately setting endOfStream=true a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affects Apache Tomcat 7.0.0 to 7.0.79 on Windows, allowing JSP file upload via HTTP PUT with specially crafted filenames (trailing spaces, dots, or ::$DATA) that bypass extension validation due to Windows filesystem normalization. Tomcat 9.0.39 is NOT affected because the upstream Apache release already included comprehensive Windows filename validation in AbstractFileResourceSet.java (commit a9dd96046d, Sept 2017). The isInvalidWindowsFilename() method explicitly rejects filenames ending in spaces or containing colons, and the canonical path comparison (lines 120-149) detects trailing dot normalization. This defense was present in the upstream 9.0.39 release before TuxCare onboarding (commit 8084b74433).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affects Apache Tomcat 7.0.0 to 7.0.79 on Windows, allowing JSP file upload via HTTP PUT with specially crafted filenames (trailing spaces, dots, or ::$DATA) that bypass extension validation due to Windows filesystem normalization. Tomcat 9.0.39 is NOT affected because the upstream Apache release already included comprehensive Windows filename validation in AbstractFileResourceSet.java (commit a9dd96046d, Sept 2017). The isInvalidWindowsFilename() method explicitly rejects filenames ending in spaces or containing colons, and the canonical path comparison (lines 120-149) detects trailing dot normalization. This defense was present in the upstream 9.0.39 release before TuxCare onboarding (commit 8084b74433).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is NOT present in Tomcat 9.0.39. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes to bypass file extension validation. The upstream fix (commits b7e0435d17 and b577f9a7996 by Mark Thomas) was already included in the 9.0.39 release that TuxCare onboarded. Both DirResourceSet.write() and AbstractFileResourceSet.file() reject paths ending with \"/\" to prevent the Java File API from dropping the trailing slash and creating files with different names than validated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is NOT present in Tomcat 9.0.39. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes to bypass file extension validation. The upstream fix (commits b7e0435d17 and b577f9a7996 by Mark Thomas) was already included in the 9.0.39 release that TuxCare onboarded. Both DirResourceSet.write() and AbstractFileResourceSet.file() reject paths ending with \"/\" to prevent the Java File API from dropping the trailing slash and creating files with different names than validated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.39. The vulnerability involved passing internal Tomcat Request/Response objects to application listeners without facade wrapping, allowing untrusted applications under SecurityManager to retain references and access/modify cross-application data. The fix was committed by Mark Thomas (markt@apache.org) on 2017-03-06 in commit dfa40863421d7681fed893b4256666491887e38c, changing fireRequestInitEvent() and fireRequestDestroyEvent() calls to use request.getRequest() facades. This fix was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded on 2026-09-12. All three affected files (FormAuthenticator.java, StandardHostValve.java, AsyncContextImpl.java) contain the corrected code using facade wrappers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is NOT present in Apache Tomcat 9.0.39. The vulnerability involved passing internal Tomcat Request/Response objects to application listeners without facade wrapping, allowing untrusted applications under SecurityManager to retain references and access/modify cross-application data. The fix was committed by Mark Thomas (markt@apache.org) on 2017-03-06 in commit dfa40863421d7681fed893b4256666491887e38c, changing fireRequestInitEvent() and fireRequestDestroyEvent() calls to use request.getRequest() facades. This fix was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded on 2026-09-12. All three affected files (FormAuthenticator.java, StandardHostValve.java, AsyncContextImpl.java) contain the corrected code using facade wrappers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 does not affect Tomcat 9.0.39. The vulnerability was fixed in upstream commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 by Mark Thomas on 2017-03-24, which was included in the 9.0.39 upstream release that TuxCare onboarded. The fix introduces SendfileState tracking to prevent the Processor from being added to the processor cache twice when sendfile completes quickly. All fix patterns are present in the target code: processSendfile() method, SendfileState enum usage, proper while loop condition checking sendfileState == SendfileState.DONE, and SocketState.SENDFILE return based on sendfileState == SendfileState.PENDING rather than sendfileData != null.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 does not affect Tomcat 9.0.39. The vulnerability was fixed in upstream commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 by Mark Thomas on 2017-03-24, which was included in the 9.0.39 upstream release that TuxCare onboarded. The fix introduces SendfileState tracking to prevent the Processor from being added to the processor cache twice when sendfile completes quickly. All fix patterns are present in the target code: processSendfile() method, SendfileState enum usage, proper while loop condition checking sendfileState == SendfileState.DONE, and SocketState.SENDFILE return based on sendfileState == SendfileState.PENDING rather than sendfileData != null.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784: The target Tomcat 9.0.39 is NOT AFFECTED. The vulnerability allowed specially crafted URLs to cause directory redirects to arbitrary URIs via protocol-relative redirects (e.g., //evil.com/). The upstream fix (commit efb860b3ff8 by Mark Thomas, 2018-09-04) was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded. The fix removes leading slashes from...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784: The target Tomcat 9.0.39 is NOT AFFECTED. The vulnerability allowed specially crafted URLs to cause directory redirects to arbitrary URIs via protocol-relative redirects (e.g., //evil.com/). The upstream fix (commit efb860b3ff8 by Mark Thomas, 2018-09-04) was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded. The fix removes leading slashes from..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:34:20.745821+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is NOT present in Tomcat 9.0.39. The vulnerability, which allowed security constraints with empty-string URL patterns (\"\") to be ignored, was fixed in upstream Tomcat 9.0.5 (released February 2018). The target version 9.0.39 (released October 2020) already contains the upstream fix authored by Mark Thomas. Both critical patches are present in RealmBase.java: (1) normalization of e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 is NOT present in Tomcat 9.0.39. The vulnerability, which allowed security constraints with empty-string URL patterns (\"\") to be ignored, was fixed in upstream Tomcat 9.0.5 (released February 2018). The target version 9.0.39 (released October 2020) already contains the upstream fix authored by Mark Thomas. Both critical patches are present in RealmBase.java: (1) normalization of e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 9.0.39. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied lazily at servlet load time, creating a race condition where resources could be accessed before constraints were registered. The fix moved annotation processing to application start time (eager evaluation). This fix was already included in the upst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 9.0.39. The vulnerability involved security constraints defined by @ServletSecurity annotations being applied lazily at servlet load time, creating a race condition where resources could be accessed before constraints were registered. The fix moved annotation processing to application start time (eager evaluation). This fix was already included in the upst..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 is NOT present in Apache Tomcat 9.0.39. The vulnerability was fixed in upstream commit 92cd494555 (April 2018) by Mark Thomas, which added position-rewinding logic to the UTF-8 decoder to prevent infinite loops when handling 4-byte supplementary characters with insufficient output buffer space. This fix was already included in the upstream Tomcat 9.0.39 release that TuxCare onboarded (commit 8084b74433, ~3022 commits after the fix). The target repository contains the complete defense code at Utf8Decoder.java lines 280-286, including the critical \"inIndex -= 3\" position rewind before returning OVERFLOW. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 is NOT present in Apache Tomcat 9.0.39. The vulnerability was fixed in upstream commit 92cd494555 (April 2018) by Mark Thomas, which added position-rewinding logic to the UTF-8 decoder to prevent infinite loops when handling 4-byte supplementary characters with insufficient output buffer space. This fix was already included in the upstream Tomcat 9.0.39 release that TuxCare onboarded (commit 8084b74433, ~3022 commits after the fix). The target repository contains the complete defense code at Utf8Decoder.java lines 280-286, including the critical \"inIndex -= 3\" position rewind before returning OVERFLOW. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 describes insecure CORS filter defaults in Apache Tomcat that enabled credentials for all origins (DEFAULT_ALLOWED_ORIGINS=\"*\" + DEFAULT_SUPPORTS_CREDENTIALS=\"true\"). The upstream fix (commit d83a76732e by markt@apache.org) changed these defaults to secure values and added validation. This fix was already present in upstream Tomcat 9.0.39, which TuxCare onboarded as-is (commit 8084b74433). The target repository contains the secure defaults and validation logic. Verdict: not_affected (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 describes insecure CORS filter defaults in Apache Tomcat that enabled credentials for all origins (DEFAULT_ALLOWED_ORIGINS=\"*\" + DEFAULT_SUPPORTS_CREDENTIALS=\"true\"). The upstream fix (commit d83a76732e by markt@apache.org) changed these defaults to secure values and added validation. This fix was already present in upstream Tomcat 9.0.39, which TuxCare onboarded as-is (commit 8084b74433). The target repository contains the secure defaults and validation logic. Verdict: not_affected (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 affects Apache Tomcat versions 9.0.0.M1 to 9.0.9 (missing hostname verification in WebSocket client TLS connections). The target version 9.0.39 already contains the upstream fix from commit 2835bb4e03 (2018-06-18) by Mark Thomas. The fix enables endpoint identification algorithm on SSLEngine to verify certificate hostnames, preventing MITM attacks. The vulnerable pattern (missing hostname verification) is not present in the target - the fix shipped in the upstream 9.0.39 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 affects Apache Tomcat versions 9.0.0.M1 to 9.0.9 (missing hostname verification in WebSocket client TLS connections). The target version 9.0.39 already contains the upstream fix from commit 2835bb4e03 (2018-06-18) by Mark Thomas. The fix enables endpoint identification algorithm on SSLEngine to verify certificate hostnames, preventing MITM attacks. The vulnerable pattern (missing hostname verification) is not present in the target - the fix shipped in the upstream 9.0.39 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:22:00.111260+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 is not present in Tomcat 9.0.39. The vulnerability affected versions 9.0.0.M9 to 9.0.9; the target version 9.0.39 is significantly newer. The upstream fix (generation tracking for async timeouts and improved connection closure tracking) was committed by Apache committer Mark Thomas on 2018-06-19 and was already present in the upstream 9.0.39 release when TuxCare onboarded it on 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 is not present in Tomcat 9.0.39. The vulnerability affected versions 9.0.0.M9 to 9.0.9; the target version 9.0.39 is significantly newer. The upstream fix (generation tracking for async timeouts and improved connection closure tracking) was committed by Apache committer Mark Thomas on 2018-06-19 and was already present in the upstream 9.0.39 release when TuxCare onboarded it on 20..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. The target version is 9.0.39, which is beyond the vulnerable range. All three defense mechanisms from the upstream patches are present: (1) stream read timeout enforcement that resets streams after timeout, (2) stream write timeout enforcement that cancels streams waiting for flow control, and (3) overhead frame tracking that closes connections sending excessive control frames. These fixes were already included in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded, authored by markt@apache.org. The vulnerable pattern (indefinite blocking without timeouts, unlimited overhead frames) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. The target version is 9.0.39, which is beyond the vulnerable range. All three defense mechanisms from the upstream patches are present: (1) stream read timeout enforcement that resets streams after timeout, (2) stream write timeout enforcement that cancels streams waiting for flow control, and (3) overhead frame tracking that closes connections sending excessive control frames. These fixes were already included in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded, authored by markt@apache.org. The vulnerable pattern (indefinite blocking without timeouts, unlimited overhead frames) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.39 is not affected by CVE-2019-0221. The vulnerable code pattern (unescaped output in SSI printenv command) has been removed by upstream Apache Tomcat. The fix was already present in the upstream 9.0.39 release before TuxCare onboarded it. The SSIPrintenv.java file at line 44 shows the fix: getVariableValue() is called with SSIMediator.ENCODING_ENTITY parameter, which perform...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.39 is not affected by CVE-2019-0221. The vulnerable code pattern (unescaped output in SSI printenv command) has been removed by upstream Apache Tomcat. The fix was already present in the upstream 9.0.39 release before TuxCare onboarded it. The SSIPrintenv.java file at line 44 shows the fix: getVariableValue() is called with SSIMediator.ENCODING_ENTITY parameter, which perform..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.39 is NOT affected by CVE-2019-0232. The vulnerability affected versions 9.0.0.M1 to 9.0.17, and the target version 9.0.39 is significantly higher. The complete fix (commit 4b244d827a by Mark Thomas) was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded. The fix adds validation of decoded CGI command line arguments against a restrictive whitelist pattern on Windows, preventing command injection. Additionally, enableCmdLineArguments is disabled by default, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "Apache Tomcat 9.0.39 is NOT affected by CVE-2019-0232. The vulnerability affected versions 9.0.0.M1 to 9.0.17, and the target version 9.0.39 is significantly higher. The complete fix (commit 4b244d827a by Mark Thomas) was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded. The fix adds validation of decoded CGI command line arguments against a restrictive whitelist pattern on Windows, preventing command injection. Additionally, enableCmdLineArguments is disabled by default, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. The target repository (Apache Tomcat 9.0.39) is not affected by CVE-2019-10072. The vulnerability was fixed in upstream Tomcat by commit 7f748eb6bf (authored by Mark Thomas on 2019-04-30), which added timeout handling to prevent indefinite thread blocking when the HTTP/2 connection window is exhausted. This fix was already present in the upstream Tomcat 9.0.39 release that TuxCare onboarded on 2026-09-12, as confirmed by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (8084b74433). The defense mechanism is correctly implemented in the target code at Http2UpgradeHandler.java:904-940 through the WindowAllocationManager abstraction, providing the same timeout-based protection as the upstream patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "The target repository (Apache Tomcat 9.0.39) is not affected by CVE-2019-10072. The vulnerability was fixed in upstream Tomcat by commit 7f748eb6bf (authored by Mark Thomas on 2019-04-30), which added timeout handling to prevent indefinite thread blocking when the HTTP/2 connection window is exhausted. This fix was already present in the upstream Tomcat 9.0.39 release that TuxCare onboarded on 2026-09-12, as confirmed by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (8084b74433). The defense mechanism is correctly implemented in the target code at Http2UpgradeHandler.java:904-940 through the WindowAllocationManager abstraction, providing the same timeout-based protection as the upstream patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-12418 is NOT present in Tomcat 9.0.39. The vulnerability, which allowed local attackers to manipulate the RMI registry for JMX man-in-the-middle attacks, was fixed by upstream Apache in commit 1fc9f589db (Nov 14, 2019) and included in Tomcat 9.0.29. The fix was already present in the upstream 9.0.39 release when TuxCare onboarded it. The current code contains the secure JmxRegistry class that prevents registry manipulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "CVE-2019-12418 is NOT present in Tomcat 9.0.39. The vulnerability, which allowed local attackers to manipulate the RMI registry for JMX man-in-the-middle attacks, was fixed by upstream Apache in commit 1fc9f589db (Nov 14, 2019) and included in Tomcat 9.0.29. The fix was already present in the upstream 9.0.39 release when TuxCare onboarded it. The current code contains the secure JmxRegistry class that prevents registry manipulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 is NOT present in Tomcat 9.0.39. The session fixation vulnerability in FORM authentication was fixed by upstream Apache Tomcat in commit 1ecba14e69 (authored by Mark Thomas), which was already included in the 9.0.39 release when TuxCare onboarded it. The fix reorders authentication checking to occur AFTER saved request restoration, preventing premature principal registration in potentially attacker-controlled sessions during the authentication flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 is NOT present in Tomcat 9.0.39. The session fixation vulnerability in FORM authentication was fixed by upstream Apache Tomcat in commit 1ecba14e69 (authored by Mark Thomas), which was already included in the 9.0.39 release when TuxCare onboarded it. The fix reorders authentication checking to occur AFTER saved request restoration, preventing premature principal registration in potentially attacker-controlled sessions during the authentication flow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 9.0.39 is NOT affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The upstream fix by Mark Thomas (commit 060ecc5eb83, Dec 17 2019) added proper validation that rejects invalid Transfer-Encoding headers with HTTP 400. This fix was already presen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.39 is NOT affected by CVE-2019-17569. The vulnerability was a regression in versions 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly processed, enabling HTTP Request Smuggling. The upstream fix by Mark Thomas (commit 060ecc5eb83, Dec 17 2019) added proper validation that rejects invalid Transfer-Encoding headers with HTTP 400. This fix was already presen..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 affects Apache Tomcat 9.0.0.M1 to 9.0.30 due to improper HTTP header end-of-line parsing that allowed invalid headers (with bare CR or control characters) to be accepted as valid, enabling HTTP Request Smuggling. The target repository is Tomcat 9.0.39, which already contains the upstream fix from commit 8bfb0ff7f25fe7555a5eb2f7984f73546c11aa26 (authored by Mark Thomas on Jan 6, 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 affects Apache Tomcat 9.0.0.M1 to 9.0.30 due to improper HTTP header end-of-line parsing that allowed invalid headers (with bare CR or control characters) to be accepted as valid, enabling HTTP Request Smuggling. The target repository is Tomcat 9.0.39, which already contains the upstream fix from commit 8bfb0ff7f25fe7555a5eb2f7984f73546c11aa26 (authored by Mark Thomas on Jan 6, 20..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Tomcat 9.0.39. The upstream Apache Tomcat project fixed this vulnerability in version 9.0.31 (released January 2020), and version 9.0.39 includes all the security patches. The fixes include: (1) secret authentication for AJP connections with secretRequired=true by default, (2) request attribute filtering blocking arbitrary attributes, and (3) default bind address changed to loopback. The AJP connector is also disabled by default in server.xml. All fix commits were authored by markt@apache.org and shipped in the upstream 9.0.39 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Tomcat 9.0.39. The upstream Apache Tomcat project fixed this vulnerability in version 9.0.31 (released January 2020), and version 9.0.39 includes all the security patches. The fixes include: (1) secret authentication for AJP connections with secretRequired=true by default, (2) request attribute filtering blocking arbitrary attributes, and (3) default bind address changed to loopback. The AJP connector is also disabled by default in server.xml. All fix commits were authored by markt@apache.org and shipped in the upstream 9.0.39 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Target is Apache Tomcat 9.0.39 (SHA 6989c4e9). CVE-2020-9484 is a deserialization RCE: an attacker-controlled session id (e.g. a JSESSIONID containing \"../\" sequences) makes org.apache.catalina.session.FileStore construct a path escaping its storage directory and deserialize an attacker-planted file. The vendor fix (Apache commit 3aa8f28db7, \"Improve validation of storage location when using FileStore.\") adds a canonical-path containment check to FileStore.file(). That exact fix is present in 9.0.39: FileStore.java lines 344-360 contain `if (!file.getCanonicalPath().startsWith(storageDir.getCanonicalPath())) { log.warn(\"fileStore.invalid\"...); return null; }`, and LocalStrings.properties:33 defines the fileStore.invalid message. The check is on every execution path to deserialization (load() calls file(id) at line 217 and short-circuits at line 218 before the ObjectInputStream at line 232; remove() and save() also route through file()). CVE lists affected 9.0.0.M1-9.0.34; the fix shipped in 9.0.35, so 9.0.39 is post-fix \u2014 verified by code, not metadata. Fix commit author is markt@apache.org (upstream Apache), not a TuxCare/CloudLinux backport; the only TuxCare backports present target other CVEs on other branches (9.0.24, 10.1.33). Hence not_affected via an upstream-authored fix already in the shipped version (code_not_present).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Target is Apache Tomcat 9.0.39 (SHA 6989c4e9). CVE-2020-9484 is a deserialization RCE: an attacker-controlled session id (e.g. a JSESSIONID containing \"../\" sequences) makes org.apache.catalina.session.FileStore construct a path escaping its storage directory and deserialize an attacker-planted file. The vendor fix (Apache commit 3aa8f28db7, \"Improve validation of storage location when using FileStore.\") adds a canonical-path containment check to FileStore.file(). That exact fix is present in 9.0.39: FileStore.java lines 344-360 contain `if (!file.getCanonicalPath().startsWith(storageDir.getCanonicalPath())) { log.warn(\"fileStore.invalid\"...); return null; }`, and LocalStrings.properties:33 defines the fileStore.invalid message. The check is on every execution path to deserialization (load() calls file(id) at line 217 and short-circuits at line 218 before the ObjectInputStream at line 232; remove() and save() also route through file()). CVE lists affected 9.0.0.M1-9.0.34; the fix shipped in 9.0.35, so 9.0.39 is post-fix \u2014 verified by code, not metadata. Fix commit author is markt@apache.org (upstream Apache), not a TuxCare/CloudLinux backport; the only TuxCare backports present target other CVEs on other branches (9.0.24, 10.1.33). Hence not_affected via an upstream-authored fix already in the shipped version (code_not_present)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "action_statement": "Vulnerability CVE-2021-24122 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2021-25329"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.39 is not affected by CVE-2022-45143. The vulnerable component (JsonErrorReportValve) does not exist in this version. JsonErrorReportValve was first introduced in version 9.0.40 (commit 295709303f), which is one version after the target. The CVE's stated affected range (9.0.40 to 9.0.68) correctly excludes 9.0.39. This is a Rule 5 Type A1 case: the component that receives the malicious input is absent from the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Apache Tomcat 9.0.39 is not affected by CVE-2022-45143. The vulnerable component (JsonErrorReportValve) does not exist in this version. JsonErrorReportValve was first introduced in version 9.0.40 (commit 295709303f), which is one version after the target. The CVE's stated affected range (9.0.40 to 9.0.68) correctly excludes 9.0.39. This is a Rule 5 Type A1 case: the component that receives the malicious input is absent from the codebase."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:46:20.750358+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "action_statement": "Vulnerability CVE-2023-28709 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "action_statement": "Vulnerability CVE-2023-34981 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "action_statement": "Vulnerability CVE-2023-46589 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "action_statement": "Vulnerability CVE-2024-21733 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:35:21.882986+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.39 is not affected by CVE-2024-52317. The vulnerability was introduced in version 9.0.93 (August 2024) when request/response recycling was added, and affects versions 9.0.92-9.0.95. Version 9.0.39 (released October 2020) predates the affected range by nearly 4 years and lacks the request/response recycling mechanism entirely. Without recycling, request/response objects cannot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.39 is not affected by CVE-2024-52317. The vulnerability was introduced in version 9.0.93 (August 2024) when request/response recycling was added, and affects versions 9.0.92-9.0.95. Version 9.0.39 (released October 2020) predates the affected range by nearly 4 years and lacks the request/response recycling mechanism entirely. Without recycling, request/response objects cannot..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.39 does not have the vulnerable HTTP/2 priority (RFC 9218) feature. The Priority parser class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and priority header processing do not exist in this version. RFC 9218 support was added in 2022-2023, after version 9.0.39 was released (2020-10-09). The vulnerability requires RFC 9218 priority field parsing, which is absent from this codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Tomcat 9.0.39 does not have the vulnerable HTTP/2 priority (RFC 9218) feature. The Priority parser class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and priority header processing do not exist in this version. RFC 9218 support was added in 2022-2023, after version 9.0.39 was released (2020-10-09). The vulnerability requires RFC 9218 priority field parsing, which is absent from this codebase."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:30:36.061493+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2026-29129 describes a regression where configured cipher preference order was not preserved in Apache Tomcat versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The bug was introduced when TLS 1.3 cipher suite configuration support was added (commit 4ee45c5571, 2026-01-06), which used a HashSet to combine cipher lists, destroying the configured order. The fix (commit 8d69b33764...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-29129 describes a regression where configured cipher preference order was not preserved in Apache Tomcat versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The bug was introduced when TLS 1.3 cipher suite configuration support was added (commit 4ee45c5571, 2026-01-06), which used a HashSet to combine cipher lists, destroying the configured order. The fix (commit 8d69b33764..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:27.082072+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CVE identifies incomplete escaping in `JsonAccessLogValve` (CVE:1). Tracked-tree inspection and repository-wide searches find neither that class nor its JSON wrappers, identifiable in the supplied patch:63. Raw URI/query appends remain at AbstractAccessLogValve.java:1185, 1396 and 1429. Their outputs pass through the element loop to a writer that appends a newline and writes the buffer (AbstractAccessLogValve.java:718, AccessLogValve.java:613). The other built-in access log implementations use W3C format or database statements (ExtendedAccessLogValve.java:44, JDBCAccessLogValve.java:516). The escaping changes are absent, but the affected JSON output component is also absent, leaving the CVE-specific path unreachable.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CVE identifies incomplete escaping in `JsonAccessLogValve` (CVE:1). Tracked-tree inspection and repository-wide searches find neither that class nor its JSON wrappers, identifiable in the supplied patch:63. Raw URI/query appends remain at AbstractAccessLogValve.java:1185, 1396 and 1429. Their outputs pass through the element loop to a writer that appends a newline and writes the buffer (AbstractAccessLogValve.java:718, AccessLogValve.java:613). The other built-in access log implementations use W3C format or database statements (ExtendedAccessLogValve.java:44, JDBCAccessLogValve.java:516). The escaping changes are absent, but the affected JSON output component is also absent, leaving the CVE-specific path unreachable."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T07:48:00.052906+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.39-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.39-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}