{
  "@id": "urn:uuid:1700f775-af21-4f87-83d8-71af838bc572",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T08:39:00.134788+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:53.139556+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16 where the name parameter in host-manager/html/add was rendered without HTML escaping. The target version 9.0.46 is not affected because the upstream Apache Tomcat project fixed this vulnerability years before the 9.0.46 release. The fix uses the Escape.htmlElementContent() utility to properly escape all ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 describes an XSS vulnerability in Apache Tomcat 5.5.9-5.5.26 and 6.0.0-6.0.16 where the name parameter in host-manager/html/add was rendered without HTML escaping. The target version 9.0.46 is not affected because the upstream Apache Tomcat project fixed this vulnerability years before the 9.0.46 release. The fix uses the Escape.htmlElementContent() utility to properly escape all ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:07:58.117916+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS through thread consumption when processing AJP requests with Content-Length: 0. The target is Tomcat 9.0.46. The upstream fix (commit 8884dae60a by Mark Thomas, March 17, 2014) was already present in the upstream Tomcat 9.0.46 release before TuxCare onboarded it. The fix is present in HEAD at java/org/apache/coyote/ajp/AjpProcess...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS through thread consumption when processing AJP requests with Content-Length: 0. The target is Tomcat 9.0.46. The upstream fix (commit 8884dae60a by Mark Thomas, March 17, 2014) was already present in the upstream Tomcat 9.0.46 release before TuxCare onboarded it. The fix is present in HEAD at java/org/apache/coyote/ajp/AjpProcess..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 9.0.46 is NOT AFFECTED by CVE-2017-12615. The vulnerability existed in Tomcat 7.x's FileDirContext architecture which lacked path validation for write operations. Tomcat 9.x uses a completely different WebResources architecture (introduced Oct 2012) that validates ALL paths via StandardRoot.validate() before write operations. Additionally, comprehensive Windows filename checks (blocking trailing spaces, colons, and trailing slashes) were added by Apache upstream in Sept 2017 (CVE-2017-12617 fixes), 4 years before Tomcat 9.0.46 was released (May 2021). All three known attack vectors (file.jsp%20, file.jsp::$DATA, file.jsp/) are explicitly blocked by defenses that shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "Tomcat 9.0.46 is NOT AFFECTED by CVE-2017-12615. The vulnerability existed in Tomcat 7.x's FileDirContext architecture which lacked path validation for write operations. Tomcat 9.x uses a completely different WebResources architecture (introduced Oct 2012) that validates ALL paths via StandardRoot.validate() before write operations. Additionally, comprehensive Windows filename checks (blocking trailing spaces, colons, and trailing slashes) were added by Apache upstream in Sept 2017 (CVE-2017-12617 fixes), 4 years before Tomcat 9.0.46 was released (May 2021). All three known attack vectors (file.jsp%20, file.jsp::$DATA, file.jsp/) are explicitly blocked by defenses that shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is NOT present in Tomcat 9.0.46. The vulnerability allowed uploading JSP files via HTTP PUT requests with paths ending in trailing slashes (e.g., \"file.jsp/\"). The upstream Apache Tomcat project fixed this vulnerability in commits b577f9a7996 and b7e0435d17 (both by Mark Thomas, September 2017), which were already included in the upstream 9.0.46 release before TuxCare onboarded it. Both required defenses are present: AbstractFileResourceSet.file() rejects file lookups when paths end in '/', and DirResourceSet.write() blocks file writes when paths end in '/'. The CVE affected versions 9.0.0.M1 to 9.0.0, but version 9.0.46 is well beyond that range and contains the upstream fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is NOT present in Tomcat 9.0.46. The vulnerability allowed uploading JSP files via HTTP PUT requests with paths ending in trailing slashes (e.g., \"file.jsp/\"). The upstream Apache Tomcat project fixed this vulnerability in commits b577f9a7996 and b7e0435d17 (both by Mark Thomas, September 2017), which were already included in the upstream 9.0.46 release before TuxCare onboarded it. Both required defenses are present: AbstractFileResourceSet.file() rejects file lookups when paths end in '/', and DirResourceSet.write() blocks file writes when paths end in '/'. The CVE affected versions 9.0.0.M1 to 9.0.0, but version 9.0.46 is well beyond that range and contains the upstream fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is not present in Apache Tomcat 9.0.46. The vulnerability involved application listeners receiving raw internal Request/Response objects instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The upstream Apache fix (commit dfa40863 by Mark Thomas) was already included in the Tomcat 9.0.46 release that TuxCare onboarded. All affected files (AsyncContextImpl.java, StandardHostValve.java, FormAuthenticator.java) correctly use request.getRequest() to obtain facade wrappers before passing to fireRequestInitEvent() and fireRequestDestroyEvent() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is not present in Apache Tomcat 9.0.46. The vulnerability involved application listeners receiving raw internal Request/Response objects instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The upstream Apache fix (commit dfa40863 by Mark Thomas) was already included in the Tomcat 9.0.46 release that TuxCare onboarded. All affected files (AsyncContextImpl.java, StandardHostValve.java, FormAuthenticator.java) correctly use request.getRequest() to obtain facade wrappers before passing to fireRequestInitEvent() and fireRequestDestroyEvent() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 describes a race condition in Apache Tomcat's HTTP connector sendfile processing where the Processor could be added to cache twice, causing response mix-up between clients. The target Apache Tomcat 9.0.46 contains the complete upstream fix (commit 9233d9d6a0 from March 2017) that was already present in the Apache 9.0.46 release before TuxCare maintenance began. The fix captures sendfile state in a separate SendfileState variable before clearing sendfileData, preventing the race condition. All fix patterns are verified present: SendfileState tracking, processSendfile() method returning captured state, and removal of premature sendfileData clearing. The vulnerable pattern (checking sendfileData != null after it could be prematurely cleared) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 describes a race condition in Apache Tomcat's HTTP connector sendfile processing where the Processor could be added to cache twice, causing response mix-up between clients. The target Apache Tomcat 9.0.46 contains the complete upstream fix (commit 9233d9d6a0 from March 2017) that was already present in the Apache 9.0.46 release before TuxCare maintenance began. The fix captures sendfile state in a separate SendfileState variable before clearing sendfileData, preventing the race condition. All fix patterns are verified present: SendfileState tracking, processSendfile() method returning captured state, and removal of premature sendfileData clearing. The vulnerable pattern (checking sendfileData != null after it could be prematurely cleared) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 is not present in target version 9.0.46. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.11, but the fix (commit efb860b3ff by Mark Thomas) was already included in the upstream Apache Tomcat 9.0.46 release that TuxCare onboarded. The vulnerable pattern (protocol-relative redirect via unescaped leading slashes) has been removed by the upstream fix present at lines 1386-1389 of D...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 is not present in target version 9.0.46. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.11, but the fix (commit efb860b3ff by Mark Thomas) was already included in the upstream Apache Tomcat 9.0.46 release that TuxCare onboarded. The vulnerable pattern (protocol-relative redirect via unescaped leading slashes) has been removed by the upstream fix present at lines 1386-1389 of D..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T14:33:24.546262+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 9.0.46 is not affected by CVE-2018-1304. The vulnerability, which allowed security constraints with empty-string URL patterns (\"\") to be ignored, was fixed in upstream commit 723ea6a5bc by Mark Thomas in February 2018. This fix was already present in Apache Tomcat 9.0.46 when TuxCare onboarded the version. The CVE affected versions 9.0.0.M1 to 9.0.4; version 9.0.46 is 4...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.46 is not affected by CVE-2018-1304. The vulnerability, which allowed security constraints with empty-string URL patterns (\"\") to be ignored, was fixed in upstream commit 723ea6a5bc by Mark Thomas in February 2018. This fix was already present in Apache Tomcat 9.0.46 when TuxCare onboarded the version. The CVE affected versions 9.0.0.M1 to 9.0.4; version 9.0.46 is 4..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.46 is not affected by CVE-2018-1305. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.4, where ServletSecurity annotations were processed at servlet load time, potentially allowing servlet load order to determine which security constraints were applied. The fix (processing all ServletSecurity annotations at application startup) was applied in Tomcat 9.0.5 (February 2018) and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.46 is not affected by CVE-2018-1305. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.4, where ServletSecurity annotations were processed at servlet load time, potentially allowing servlet load order to determine which security constraints were applied. The fix (processing all ServletSecurity annotations at application startup) was applied in Tomcat 9.0.5 (February 2018) and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 affects Tomcat versions 9.0.0.M9 to 9.0.7 due to improper overflow handling in the UTF-8 decoder with supplementary characters, which could lead to an infinite loop and DoS. The target version 9.0.46 is not affected because the upstream fix (commit 92cd494555) was already present in Tomcat 9.0.8 (released April 2018), well before the 9.0.46 release. The fix adds proper input buffer position rewinding when the output buffer lacks space for supplementary characters, preventing the infinite loop. This fix was authored by the upstream Apache Tomcat maintainer (markt@apache.org) and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 affects Tomcat versions 9.0.0.M9 to 9.0.7 due to improper overflow handling in the UTF-8 decoder with supplementary characters, which could lead to an infinite loop and DoS. The target version 9.0.46 is not affected because the upstream fix (commit 92cd494555) was already present in Tomcat 9.0.8 (released April 2018), well before the 9.0.46 release. The fix adds proper input buffer position rewinding when the output buffer lacks space for supplementary characters, preventing the infinite loop. This fix was authored by the upstream Apache Tomcat maintainer (markt@apache.org) and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 affects Apache Tomcat 9.0.0.M1 to 9.0.8 with insecure CORS filter defaults (allowedOrigins=\"*\" + supportsCredentials=true). The target version 9.0.46 is beyond the affected range and already contains the upstream fix (commit d83a76732e by markt@apache.org) that shipped with the release. All three fix aspects are present: DEFAULT_ALLOWED_ORIGINS=\"\" (line 1035), DEFAULT_SUPPORTS_CREDENTIALS=false (line 1051), and validation preventing the insecure combination (lines 728-730). The fix was already in the upstream release when TuxCare onboarded version 9.0.46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 affects Apache Tomcat 9.0.0.M1 to 9.0.8 with insecure CORS filter defaults (allowedOrigins=\"*\" + supportsCredentials=true). The target version 9.0.46 is beyond the affected range and already contains the upstream fix (commit d83a76732e by markt@apache.org) that shipped with the release. All three fix aspects are present: DEFAULT_ALLOWED_ORIGINS=\"\" (line 1035), DEFAULT_SUPPORTS_CREDENTIALS=false (line 1051), and validation preventing the insecure combination (lines 728-730). The fix was already in the upstream release when TuxCare onboarded version 9.0.46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 is NOT present in Apache Tomcat 9.0.46. The vulnerability concerns missing hostname verification when using TLS with the WebSocket client, allowing man-in-the-middle attacks. The fix (enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\")) was applied by Apache upstream in commit 2835bb4e030c (June 2018) and shipped with Tomcat 9.0.46 when released in April 2021, before TuxCare onboarded this version in September 2025. The target code contains the complete fix: createSSLEngine method accepts host/port parameters, creates SSLEngine with these parameters, and enables endpoint identification algorithm.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 is NOT present in Apache Tomcat 9.0.46. The vulnerability concerns missing hostname verification when using TLS with the WebSocket client, allowing man-in-the-middle attacks. The fix (enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\")) was applied by Apache upstream in commit 2835bb4e030c (June 2018) and shipped with Tomcat 9.0.46 when released in April 2021, before TuxCare onboarded this version in September 2025. The target code contains the complete fix: createSSLEngine method accepts host/port parameters, creates SSLEngine with these parameters, and enables endpoint identification algorithm.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T01:22:34.338050+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target Apache Tomcat 9.0.46 is not affected by CVE-2018-8037. The vulnerability affects versions 9.0.0.M9 to 9.0.9. All fixes for the async timeout race condition were shipped in the upstream Apache Tomcat release before TuxCare onboarded version 9.0.46. The complete defense mechanisms are present: (1) generation counter tracking async lifecycle stages, (2) checkAsyncTimeoutGeneration() prevent...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 9.0.46 is not affected by CVE-2018-8037. The vulnerability affects versions 9.0.0.M9 to 9.0.9. All fixes for the async timeout race condition were shipped in the upstream Apache Tomcat release before TuxCare onboarded version 9.0.46. The complete defense mechanisms are present: (1) generation counter tracking async lifecycle stages, (2) checkAsyncTimeoutGeneration() prevent..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14. The target is Tomcat 9.0.46, which already includes all upstream fixes for this CVE. The vulnerability allowed DoS through excessive HTTP/2 control frames and streams without data transfer, causing thread exhaustion. The upstream patches added stream-level read/write timeouts and overhead frame tracking. All three defenses are present and enforced in the target: (1) stream write timeout at Stream.java:215-220, (2) stream read timeout at Stream.java:1057-1076, and (3) overhead tracking/enforcement at Http2UpgradeHandler.java:146,356-360. The fix was committed by Apache's Mark Thomas in February 2019 (commits c38033338a and f9d8c2591f), predating the Tomcat 9.0.46 release (March 2021) and the TuxCare onboarding (September 2025).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14. The target is Tomcat 9.0.46, which already includes all upstream fixes for this CVE. The vulnerability allowed DoS through excessive HTTP/2 control frames and streams without data transfer, causing thread exhaustion. The upstream patches added stream-level read/write timeouts and overhead frame tracking. All three defenses are present and enforced in the target: (1) stream write timeout at Stream.java:215-220, (2) stream read timeout at Stream.java:1057-1076, and (3) overhead tracking/enforcement at Http2UpgradeHandler.java:146,356-360. The fix was committed by Apache's Mark Thomas in February 2019 (commits c38033338a and f9d8c2591f), predating the Tomcat 9.0.46 release (March 2021) and the TuxCare onboarding (September 2025).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target repository (Apache Tomcat 9.0.46) is NOT AFFECTED by CVE-2019-0221. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache in March 2019 (commit 15fcd166ea) before TuxCare began maintaining this version. The fix applies HTML entity encoding to variable values via SSIMediator.ENCODING_ENTITY, preventing script execution. The vulnerable cod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 9.0.46) is NOT AFFECTED by CVE-2019-0221. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache in March 2019 (commit 15fcd166ea) before TuxCare began maintaining this version. The fix applies HTML entity encoding to variable values via SSIMediator.ENCODING_ENTITY, preventing script execution. The vulnerable cod..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.46 is not affected by CVE-2019-0232. The fix was already present in the upstream release 9.0.46 before TuxCare onboarded this version. The vulnerability required Windows with enableCmdLineArguments enabled, and the upstream fix validates decoded command line arguments against a restrictive pattern to prevent command injection. Additionally, enableCmdLineArguments defaults to false, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "Apache Tomcat 9.0.46 is not affected by CVE-2019-0232. The fix was already present in the upstream release 9.0.46 before TuxCare onboarded this version. The vulnerability required Windows with enableCmdLineArguments enabled, and the upstream fix validates decoded command line arguments against a restrictive pattern to prevent command injection. Additionally, enableCmdLineArguments defaults to false, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 9.0.46-tuxcare.12 is NOT vulnerable to CVE-2019-10072 (HTTP/2 connection window exhaustion leading to DoS). The vulnerability affected Tomcat 9.0.0.M1 to 9.0.19 and was fixed in 9.0.20 (May 2019). The target version 9.0.46 (released May 2021) already contains the upstream fix from commits 7f748eb6 and ada725a5, which add timeout handling to connection-level window reservation waits. When the connection window is exhausted and no WINDOW_UPDATE is received within the timeout period, the connection and stream are closed, preventing indefinite thread blocking. The fix was authored by Mark Thomas (markt@apache.org) and was present in the upstream 9.0.46 release when TuxCare onboarded it on 2025-09-17.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "Target Apache Tomcat 9.0.46-tuxcare.12 is NOT vulnerable to CVE-2019-10072 (HTTP/2 connection window exhaustion leading to DoS). The vulnerability affected Tomcat 9.0.0.M1 to 9.0.19 and was fixed in 9.0.20 (May 2019). The target version 9.0.46 (released May 2021) already contains the upstream fix from commits 7f748eb6 and ada725a5, which add timeout handling to connection-level window reservation waits. When the connection window is exhausted and no WINDOW_UPDATE is received within the timeout period, the connection and stream are closed, preventing indefinite thread blocking. The fix was authored by Mark Thomas (markt@apache.org) and was present in the upstream 9.0.46 release when TuxCare onboarded it on 2025-09-17.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.46 is not affected by CVE-2019-12418. The vulnerability affected versions 9.0.0.M1 to 9.0.28. The fix was introduced in upstream version 9.0.29 (commit 1fc9f589db on 2019-11-14 by remm@apache.org) and is present in all subsequent releases including 9.0.46. The target contains the custom JmxRegistry implementation that prevents RMI registry manipulation, eliminating the man-in-the-middle attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "Apache Tomcat 9.0.46 is not affected by CVE-2019-12418. The vulnerability affected versions 9.0.0.M1 to 9.0.28. The fix was introduced in upstream version 9.0.29 (commit 1fc9f589db on 2019-11-14 by remm@apache.org) and is present in all subsequent releases including 9.0.46. The target contains the custom JmxRegistry implementation that prevents RMI registry manipulation, eliminating the man-in-the-middle attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-17563 affects Apache Tomcat 9.0.0.M1 to 9.0.29. The target is version 9.0.46, which was released on 2021-05-08, well after the upstream fix was committed on 2019-12-05. The fix is present in the upstream release that TuxCare onboarded. The vulnerable code patterns (storing Principal in FORM_PRINCIPAL_NOTE session note, early checkForCachedAuthentication call before matchRequest) are absent. The target has the patched logic: checkForCachedAuthentication is called after matchRequest (line 188), matchRequest checks the correct Principal location based on cache flag (line 515), and FORM_PRINCIPAL_NOTE is deprecated and unused.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "CVE-2019-17563 affects Apache Tomcat 9.0.0.M1 to 9.0.29. The target is version 9.0.46, which was released on 2021-05-08, well after the upstream fix was committed on 2019-12-05. The fix is present in the upstream release that TuxCare onboarded. The vulnerable code patterns (storing Principal in FORM_PRINCIPAL_NOTE session note, early checkForCachedAuthentication call before matchRequest) are absent. The target has the patched logic: checkForCachedAuthentication is called after matchRequest (line 188), matchRequest checks the correct Principal location based on cache flag (line 515), and FORM_PRINCIPAL_NOTE is deprecated and unused.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 is NOT present in Apache Tomcat 9.0.46. The vulnerability was a regression introduced in 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly ignored instead of being rejected. The fix was applied in upstream version 9.0.31 (commit 060ecc5eb8 by Mark Thomas, 2019-12-17) and is present in the target version 9.0.46. The code at java/org/apache/coyote/http11/Http11...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 is NOT present in Apache Tomcat 9.0.46. The vulnerability was a regression introduced in 9.0.28-9.0.30 where invalid Transfer-Encoding headers were incorrectly ignored instead of being rejected. The fix was applied in upstream version 9.0.31 (commit 060ecc5eb8 by Mark Thomas, 2019-12-17) and is present in the target version 9.0.46. The code at java/org/apache/coyote/http11/Http11..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Version 9.0.46 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. It contains both the initial fix (commit 9a0231683a) and a subsequent optimization (commit f258efef6c) that prevent the DoS vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 9.0.46 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. It contains both the initial fix (commit 9a0231683a) and a subsequent optimization (commit f258efef6c) that prevent the DoS vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target is Apache Tomcat 9.0.46, which is outside the CVE-2020-1935 affected range (9.0.0.M1-9.0.30 per vendor). While the target accepts bare LF as a line terminator (which the CVE-2020-1935 fix initially removed), Apache Tomcat intentionally restored this behavior via bug 65272 for compatibility, while retaining the security-critical control character validation from the CVE fix. The vendor co...",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Target is Apache Tomcat 9.0.46, which is outside the CVE-2020-1935 affected range (9.0.0.M1-9.0.30 per vendor). While the target accepts bare LF as a line terminator (which the CVE-2020-1935 fix initially removed), Apache Tomcat intentionally restored this behavior via bug 65272 for compatibility, while retaining the security-critical control character validation from the CVE fix. The vendor co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is not present in Apache Tomcat 9.0.46. All three upstream fixes for this vulnerability were already included in the Apache Tomcat 9.0.46 release: (1) AJP connector defaults to loopback binding, (2) secret authentication is required by default, and (3) arbitrary AJP request attributes are blocked with 403 responses. Additionally, the AJP connector is disabled by default in the shipped server.xml configuration. The fixes were authored by Mark Thomas (Apache upstream) and shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is not present in Apache Tomcat 9.0.46. All three upstream fixes for this vulnerability were already included in the Apache Tomcat 9.0.46 release: (1) AJP connector defaults to loopback binding, (2) secret authentication is required by default, and (3) arbitrary AJP request attributes are blocked with 403 responses. Additionally, the AJP connector is disabled by default in the shipped server.xml configuration. The fixes were authored by Mark Thomas (Apache upstream) and shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. The target Apache Tomcat 9.0.46 is NOT affected by CVE-2021-25122. All fixes for this h2c request data leakage vulnerability were already present in the upstream Apache Tomcat 9.0.46 release before TuxCare/CloudLinux onboarding. The vulnerability affected versions up to 9.0.41; version 9.0.42 and above contain the complete fix authored by Mark Thomas (markt@apache.org) addressing BZ 64830. The fix includes: (1) proper sequencing of leftover input restoration before processor creation, (2) correct HTTP/1.1 processor release before h2c upgrade, (3) thread-safe HPACK decoder with local StringBuilder instances, and (4) thread-safe ConnectionSettings using ConcurrentHashMap.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "The target Apache Tomcat 9.0.46 is NOT affected by CVE-2021-25122. All fixes for this h2c request data leakage vulnerability were already present in the upstream Apache Tomcat 9.0.46 release before TuxCare/CloudLinux onboarding. The vulnerability affected versions up to 9.0.41; version 9.0.42 and above contain the complete fix authored by Mark Thomas (markt@apache.org) addressing BZ 64830. The fix includes: (1) proper sequencing of leftover input restoration before processor creation, (2) correct HTTP/1.1 processor release before h2c upgrade, (3) thread-safe HPACK decoder with local StringBuilder instances, and (4) thread-safe ConnectionSettings using ConcurrentHashMap.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Target Tomcat 9.0.46 is NOT AFFECTED by CVE-2021-25329. The vulnerability involves path traversal due to inadequate directory containment validation using string-based canonical path matching (`getCanonicalPath().startsWith()`). The upstream Apache Tomcat 9.0.46 release already contains the fix (commit 4785433a by Mark Thomas, Jan 20 2021) which replaces the vulnerable pattern with `java.nio.file.Path.startsWith()` for correct filesystem hierarchy validation. All five affected files (DefaultServlet.java, FileStore.java, ContextConfig.java, ExpandWar.java, HostConfig.java) use the fixed pattern. No instances of the vulnerable pattern remain in the codebase. This is an upstream fix that shipped with the 9.0.46 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "Target Tomcat 9.0.46 is NOT AFFECTED by CVE-2021-25329. The vulnerability involves path traversal due to inadequate directory containment validation using string-based canonical path matching (`getCanonicalPath().startsWith()`). The upstream Apache Tomcat 9.0.46 release already contains the fix (commit 4785433a by Mark Thomas, Jan 20 2021) which replaces the vulnerable pattern with `java.nio.file.Path.startsWith()` for correct filesystem hierarchy validation. All five affected files (DefaultServlet.java, FileStore.java, ContextConfig.java, ExpandWar.java, HostConfig.java) use the fixed pattern. No instances of the vulnerable pattern remain in the codebase. This is an upstream fix that shipped with the 9.0.46 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2022-45143"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "action_statement": "Vulnerability CVE-2023-28709 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "action_statement": "Vulnerability CVE-2023-34981 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-28T21:56:00.190980+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.11."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:41:00.083121+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11 through 9.0.43. The target is Tomcat 9.0.46, which already includes the upstream fix (commit d1da266aa1) that was released in version 9.0.44. The fix adds IS_IO_ALLOWED checks in ErrorReportValve to prevent error messages from being written when I/O operations are not permitted, thus preventing information disclosure. This fix was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11 through 9.0.43. The target is Tomcat 9.0.46, which already includes the upstream fix (commit d1da266aa1) that was released in version 9.0.44. The fix adds IS_IO_ALLOWED checks in ErrorReportValve to prevent error messages from being written when I/O operations are not permitted, thus preventing information disclosure. This fix was ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-28T21:56:00.190980+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:33:25.157477+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.46 is NOT AFFECTED by CVE-2024-52317. The vulnerability concerns incorrect recycling of HTTP/2 request/response objects, but version 9.0.46 does not implement request/response recycling at all. Recycling was introduced in commit 3c5b14b713 (July 2024), which is not present in the 9.0.46 branch. The CVE affects versions 9.0.92-9.0.95 where recycling exists but has a race condi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.46 is NOT AFFECTED by CVE-2024-52317. The vulnerability concerns incorrect recycling of HTTP/2 request/response objects, but version 9.0.46 does not implement request/response recycling at all. Recycling was introduced in commit 3c5b14b713 (July 2024), which is not present in the 9.0.46 branch. The CVE affects versions 9.0.92-9.0.95 where recycling exists but has a race condi..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Version 9.0.46 is not vulnerable. Summary: The target repository is running Apache Tomcat version 9.0.46, which predates the affected version range for CVE-2025-31650. The vulnerability affects versions 9.0.76 through 9.0.102 for Tomcat 9.x, and this version (9.0.46) is not within that range. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Version 9.0.46 is not vulnerable. Summary: The target repository is running Apache Tomcat version 9.0.46, which predates the affected version range for CVE-2025-31650. The vulnerability affects versions 9.0.76 through 9.0.102 for Tomcat 9.x, and this version (9.0.46) is not within that range. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2026-29129 affects Apache Tomcat 9.0.114-9.0.115 due to a regression introduced when TLS 1.3 cipher suite configuration support was added. The vulnerable code pattern (using unordered HashSet to combine cipher lists, losing configured preference order) does not exist in version 9.0.46. This version predates the feature introduction by approximately 5 years and uses a simpler, correct implem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-29129 affects Apache Tomcat 9.0.114-9.0.115 due to a regression introduced when TLS 1.3 cipher suite configuration support was added. The vulnerable code pattern (using unordered HashSet to combine cipher lists, losing configured preference order) does not exist in version 9.0.46. This version predates the feature introduction by approximately 5 years and uses a simpler, correct implem..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 does not affect version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core. Version 9.0.46 is not vulnerable. Summary: CVE-2026-34483 does NOT affect Tomcat 9.0.46. The vulnerable component JsonAccessLogValve was introduced in version 9.0.74 (April 2023), almost 2 years after version 9.0.46 was released (May 2021). The target version predates the introduction of the vulnerable feature. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "impact_statement": "Version 9.0.46 is not vulnerable. Summary: CVE-2026-34483 does NOT affect Tomcat 9.0.46. The vulnerable component JsonAccessLogValve was introduced in version 9.0.74 (April 2023), almost 2 years after version 9.0.46 was released (May 2021). The target version predates the introduction of the vulnerable feature. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-05T08:39:00.134788+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.14.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.14."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-05T08:39:00.134788+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.14.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.14."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-03T18:00:27.876726+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.13.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.46-tuxcare.13."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.46-tuxcare.9 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.46-tuxcare.9.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}