{
  "@id": "urn:uuid:868a38fb-12f6-4a25-a95c-a527016a9a30",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 60,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T21:46:09.756674+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2008-1947 XSS vulnerability is not present in Apache Tomcat 9.0.83. The vulnerable code pattern (unescaped reflection of the 'name' parameter in HTML output) was fixed by Apache upstream in commit 17fdaef177 (Oct 2017), which introduced the Escape.htmlElementContent() defense. This fix shipped in the upstream 9.0.83 release before TuxCare onboarded it. The defense encodes HTML metacharacter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 XSS vulnerability is not present in Apache Tomcat 9.0.83. The vulnerable code pattern (unescaped reflection of the 'name' parameter in HTML output) was fixed by Apache upstream in commit 17fdaef177 (Oct 2017), which introduced the Escape.htmlElementContent() defense. This fix shipped in the upstream 9.0.83 release before TuxCare onboarded it. The defense encodes HTML metacharacter..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:01.860590+00:00",
      "status_notes": "Vulnerability CVE-2014-0095 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2014-0095 is not present in Apache Tomcat 9.0.83. The vulnerability, which caused thread hangs when processing AJP requests with Content-Length: 0, was fixed by upstream Apache in commit 8884dae60a on March 17, 2014 (authored by Mark Thomas). This fix was already included in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded, more than 11 years before TuxCare began maintenance...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0095"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0095 is not present in Apache Tomcat 9.0.83. The vulnerability, which caused thread hangs when processing AJP requests with Content-Length: 0, was fixed by upstream Apache in commit 8884dae60a on March 17, 2014 (authored by Mark Thomas). This fix was already included in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded, more than 11 years before TuxCare began maintenance..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12615 affects Tomcat 7.0.0-7.0.79 on Windows, allowing JSP upload via specially crafted filenames (trailing spaces/dots that Windows normalizes). The target is Tomcat 9.0.83, which uses a completely different architecture (WebResourceRoot/WebResourceSet vs FileDirContext). The equivalent vulnerability in Tomcat 9 was CVE-2017-12617, fixed in upstream Tomcat 9.0.1 (Sept 2017) via commit a9dd96046d by Mark Thomas. This fix added isInvalidWindowsFilename() validation that explicitly rejects trailing spaces and canonical-vs-absolute path comparison that catches other Windows normalizations. The fix was present in upstream release before TuxCare onboarded 9.0.83. Verdict: not_affected (upstream fix shipped in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "impact_statement": "CVE-2017-12615 affects Tomcat 7.0.0-7.0.79 on Windows, allowing JSP upload via specially crafted filenames (trailing spaces/dots that Windows normalizes). The target is Tomcat 9.0.83, which uses a completely different architecture (WebResourceRoot/WebResourceSet vs FileDirContext). The equivalent vulnerability in Tomcat 9 was CVE-2017-12617, fixed in upstream Tomcat 9.0.1 (Sept 2017) via commit a9dd96046d by Mark Thomas. This fix added isInvalidWindowsFilename() validation that explicitly rejects trailing spaces and canonical-vs-absolute path comparison that catches other Windows normalizations. The fix was present in upstream release before TuxCare onboarded 9.0.83. Verdict: not_affected (upstream fix shipped in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.79), NVD (>= 7.0.0, <= 7.0.79), cve.org (>= 7.0.0, <= 7.0.79), Snyk (>= 7.0.0, < 7.0.81)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-12617 is NOT present in Tomcat 9.0.83. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes (e.g., \"evil.jsp/\"). The Java File API silently drops trailing slashes, causing path confusion that bypassed security checks. The upstream fix (commit b7e0435d17 by markt@apache.org) was already included in version 9.0.83 before TuxCare onboarding. The fix adds two defenses: (1) file lookup rejects paths ending in '/' when they resolve to files (AbstractFileResourceSet.file() lines 66-71), and (2) file creation rejects paths ending in '/' (DirResourceSet.write() lines 264-268). Both defenses are present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "CVE-2017-12617 is NOT present in Tomcat 9.0.83. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes (e.g., \"evil.jsp/\"). The Java File API silently drops trailing slashes, causing path confusion that bypassed security checks. The upstream fix (commit b7e0435d17 by markt@apache.org) was already included in version 9.0.83 before TuxCare onboarding. The fix adds two defenses: (1) file lookup rejects paths ending in '/' when they resolve to files (AbstractFileResourceSet.file() lines 66-71), and (2) file creation rejects paths ending in '/' (DirResourceSet.write() lines 264-268). Both defenses are present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648 is not present in Tomcat 9.0.83. The vulnerability concerned improper use of internal request/response objects (instead of facades) when firing application listeners, allowing untrusted applications to retain references and access data from other web applications. The upstream fix (commit dfa4086342 by markt@apache.org) was applied in Tomcat 9.0.0-M18 (March 2017) and shipped in the upstream release that TuxCare onboarded. All affected code locations now correctly use request.getRequest() to pass facade objects to listener methods (fireRequestInitEvent/fireRequestDestroyEvent), preventing cross-application data access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 is not present in Tomcat 9.0.83. The vulnerability concerned improper use of internal request/response objects (instead of facades) when firing application listeners, allowing untrusted applications to retain references and access data from other web applications. The upstream fix (commit dfa4086342 by markt@apache.org) was applied in Tomcat 9.0.0-M18 (March 2017) and shipped in the upstream release that TuxCare onboarded. All affected code locations now correctly use request.getRequest() to pass facade objects to listener methods (fireRequestInitEvent/fireRequestDestroyEvent), preventing cross-application data access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5651 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5651 is not present in Tomcat 9.0.83. The vulnerability involved a race condition where the Http11Processor could be added to the processor cache twice during fast sendfile completion, leading to response mix-up between different client requests. The upstream Apache Tomcat project fixed this issue in commit 9233d9d6a0 (March 24, 2017) by tracking sendfile state separately from the sendfileData field that gets cleared during processor recycling. This fix was already present in the upstream release before TuxCare onboarded version 9.0.83. The target code correctly implements all fix elements: SendfileState tracking, while loop condition checks, proper return status determination, and the processSendfile() method that prevents double-caching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5651"
      },
      "impact_statement": "CVE-2017-5651 is not present in Tomcat 9.0.83. The vulnerability involved a race condition where the Http11Processor could be added to the processor cache twice during fast sendfile completion, leading to response mix-up between different client requests. The upstream Apache Tomcat project fixed this issue in commit 9233d9d6a0 (March 24, 2017) by tracking sendfile state separately from the sendfileData field that gets cleared during processor recycling. This fix was already present in the upstream release before TuxCare onboarded version 9.0.83. The target code correctly implements all fix elements: SendfileState tracking, while loop condition checks, proper return status determination, and the processSendfile() method that prevents double-caching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-11784 describes a protocol-relative redirect vulnerability in Apache Tomcat's DefaultServlet. The vulnerability allowed attackers to craft URLs that caused redirects to arbitrary domains via protocol-relative URLs (e.g., \"//evil.com\"). The fix (commit efb860b3ff by markt@apache.org) adds code to strip leading forward slashes from redirect locations. Target version 9.0.83 is NOT AFFECTE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11784 describes a protocol-relative redirect vulnerability in Apache Tomcat's DefaultServlet. The vulnerability allowed attackers to craft URLs that caused redirects to arbitrary domains via protocol-relative URLs (e.g., \"//evil.com\"). The fix (commit efb860b3ff by markt@apache.org) adds code to strip leading forward slashes from redirect locations. Target version 9.0.83 is NOT AFFECTE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T14:33:24.546262+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1304 is NOT present in Tomcat 9.0.83. The vulnerability involved security constraints with URL pattern \"\" (empty string) not matching the context root \"/\", causing the constraint to be ignored and allowing unauthorized access. The upstream fix (commit 723ea6a5bc by Mark Thomas) was already present in the upstream release before TuxCare onboarding. Both parts of the fix are present in R...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1304 is NOT present in Tomcat 9.0.83. The vulnerability involved security constraints with URL pattern \"\" (empty string) not matching the context root \"/\", causing the constraint to be ignored and allowing unauthorized access. The upstream fix (commit 723ea6a5bc by Mark Thomas) was already present in the upstream release before TuxCare onboarding. Both parts of the fix are present in R..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 9.0.83. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.4, where security constraints defined by @ServletSecurity annotations were only applied when a servlet was loaded, creating a window where resources could be accessed without authorization depending on servlet load order. The upstream fix (commit 3e54b2a6314eda) was applied in February 2018 by Apach...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Tomcat 9.0.83. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.4, where security constraints defined by @ServletSecurity annotations were only applied when a servlet was loaded, creating a window where resources could be accessed without authorization depending on servlet load order. The upstream fix (commit 3e54b2a6314eda) was applied in February 2018 by Apach..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-1336 does not affect Apache Tomcat 9.0.83. The vulnerability (infinite loop in UTF-8 decoder with supplementary characters) was fixed by upstream Apache in commit 92cd494555 on April 27, 2018. This fix was already present in the upstream 9.0.83 release (November 2023) when TuxCare onboarded it. The CVE explicitly states affected versions are 9.0.0.M9 to 9.0.7; version 9.0.83 is far beyond this range. The fix code is verified present in Utf8Decoder.java at lines 270-275, properly handling buffer overflow by resetting the input position when insufficient output space exists for supplementary characters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 does not affect Apache Tomcat 9.0.83. The vulnerability (infinite loop in UTF-8 decoder with supplementary characters) was fixed by upstream Apache in commit 92cd494555 on April 27, 2018. This fix was already present in the upstream 9.0.83 release (November 2023) when TuxCare onboarded it. The CVE explicitly states affected versions are 9.0.0.M9 to 9.0.7; version 9.0.83 is far beyond this range. The fix code is verified present in Utf8Decoder.java at lines 270-275, properly handling buffer overflow by resetting the input position when insufficient output space exists for supplementary characters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M9, < 9.0.8; >= 8.5.0, < 8.5.31; >= 8.0.0RC1, < 8.0.51; >= 7.0.28, < 7.0.87), NVD (>= 7.0.28, <= 7.0.86; >= 8.0.0, <= 8.0.51; >= 8.5.0, <= 8.5.30; >= 9.0.1, <= 9.0.7; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone9), cve.org (>= 9.0.0.M9, <= 9.0.7; >= 8.5.0, <= 8.5.30; >= 8.0.0.RC1, <= 8.0.51; >= 7.0.28, <= 7.0.86), Snyk (< 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10; < 7.0.90; >= 8.0.0, < 8.0.52; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8014 concerns insecure CORS filter defaults in Apache Tomcat that enabled supportsCredentials for all origins. The target (Tomcat 9.0.83-tuxcare.6) contains the upstream fix authored by Mark Thomas (markt@apache.org) in commit d83a76732e, which was already present in the Apache Tomcat 9.0.83 release that TuxCare onboarded. The fix changes DEFAULT_ALLOWED_ORIGINS from \"*\" to \"\" (empty string), DEFAULT_SUPPORTS_CREDENTIALS from \"true\" to \"false\", and adds validation that throws ServletException if both are dangerously configured together. All three patch components are present in the target code. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 concerns insecure CORS filter defaults in Apache Tomcat that enabled supportsCredentials for all origins. The target (Tomcat 9.0.83-tuxcare.6) contains the upstream fix authored by Mark Thomas (markt@apache.org) in commit d83a76732e, which was already present in the Apache Tomcat 9.0.83 release that TuxCare onboarded. The fix changes DEFAULT_ALLOWED_ORIGINS from \"*\" to \"\" (empty string), DEFAULT_SUPPORTS_CREDENTIALS from \"true\" to \"false\", and adds validation that throws ServletException if both are dangerously configured together. All three patch components are present in the target code. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.9; >= 8.5.0, < 8.5.32; >= 8.0.0RC1, < 8.0.53; >= 7.0.41, < 7.0.88), NVD (>= 7.0.41, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.0, <= 9.0.8; = 8.0.0-rc1; = 9.0.0-milestone1), cve.org (>= 9.0.0.M1, <= 9.0.8; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.41, <= 7.0.88), Snyk (< 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9; < 7.0.89; >= 8.0.0, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0, < 9.0.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2018-8034 (missing hostname verification in WebSocket client TLS connections) is not present in Apache Tomcat 9.0.83. The upstream fix (commit 2835bb4e by Mark Thomas) was already included in the upstream release that TuxCare onboarded. The fix at lines 929-935 of WsWebSocketContainer.java unconditionally enables hostname verification by calling sslParams.setEndpointIdentificationAlgorithm(\"HTTPS\") on all WebSocket client TLS connections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 (missing hostname verification in WebSocket client TLS connections) is not present in Apache Tomcat 9.0.83. The upstream fix (commit 2835bb4e by Mark Thomas) was already included in the upstream release that TuxCare onboarded. The fix at lines 929-935 of WsWebSocketContainer.java unconditionally enables hostname verification by calling sslParams.setEndpointIdentificationAlgorithm(\"HTTPS\") on all WebSocket client TLS connections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.10; >= 8.5.0, < 8.5.32; >= 8.0.0, < 8.0.53; >= 7.0.35, < 7.0.90), NVD (>= 7.0.35, <= 7.0.88; >= 8.0.0, <= 8.0.52; >= 8.5.0, <= 8.5.31; >= 9.0.1, <= 9.0.9; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc2; = 8.0.0-rc3; = 8.0.0-rc4; = 8.0.0-rc5; = 8.0.0-rc6; = 8.0.0-rc7; = 8.0.0-rc8; = 8.0.0-rc9; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.9; >= 8.5.0, <= 8.5.31; >= 8.0.0.RC1, <= 8.0.52; >= 7.0.35, <= 7.0.88), Snyk (>= 8.0.0-RC1, < 8.0.53; >= 8.5.0, < 8.5.32; >= 9.0.0.M1, < 9.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T01:21:00.558311+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2018-8037 describes a race condition in async request handling that could result in response data being delivered to the wrong user. The vulnerability affected Tomcat 9.0.0.M9 to 9.0.9. The target version 9.0.83 contains the complete upstream fix, which was applied by Apache Tomcat developers and shipped in the upstream release before TuxCare onboarded it. The fix consists of two parts: (1)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8037 describes a race condition in async request handling that could result in response data being delivered to the wrong user. The vulnerability affected Tomcat 9.0.0.M9 to 9.0.9. The target version 9.0.83 contains the complete upstream fix, which was applied by Apache Tomcat developers and shipped in the upstream release before TuxCare onboarded it. The fix consists of two parts: (1)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0199 is NOT present in Apache Tomcat 9.0.83. The vulnerability affected versions 9.0.0.M1 to 9.0.14 (and 8.5.0 to 8.5.37). Apache fixed this in February 2019 by adding stream-level read/write timeouts and overhead frame tracking to prevent thread exhaustion DoS. All three defense mechanisms are present and functional in version 9.0.83: (1) stream read timeout enforcement at Stream.java:1247-1262, (2) stream write timeout enforcement at Stream.java:254-259, and (3) overhead frame limit enforcement at Http2UpgradeHandler.java:388-392. These fixes were authored by Apache committer Mark Thomas and shipped in the upstream 9.0.83 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "impact_statement": "CVE-2019-0199 is NOT present in Apache Tomcat 9.0.83. The vulnerability affected versions 9.0.0.M1 to 9.0.14 (and 8.5.0 to 8.5.37). Apache fixed this in February 2019 by adding stream-level read/write timeouts and overhead frame tracking to prevent thread exhaustion DoS. All three defense mechanisms are present and functional in version 9.0.83: (1) stream read timeout enforcement at Stream.java:1247-1262, (2) stream write timeout enforcement at Stream.java:254-259, and (3) overhead frame limit enforcement at Http2UpgradeHandler.java:388-392. These fixes were authored by Apache committer Mark Thomas and shipped in the upstream 9.0.83 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 9.0.83. The vulnerability (SSI printenv command echoing user data without escaping, leading to XSS) was fixed by upstream commit 15fcd166ea on 2019-03-11 by Mark Thomas (markt@apache.org). This fix was already present in the Apache Tomcat 9.0.83 release before TuxCare onboarded it. The current code applies HTML entity encoding via SSIMediator.ENCODING_ENTI...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 9.0.83. The vulnerability (SSI printenv command echoing user data without escaping, leading to XSS) was fixed by upstream commit 15fcd166ea on 2019-03-11 by Mark Thomas (markt@apache.org). This fix was already present in the Apache Tomcat 9.0.83 release before TuxCare onboarded it. The current code applies HTML entity encoding via SSIMediator.ENCODING_ENTI..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-0232 describes a Windows-specific Remote Code Execution vulnerability in Tomcat's CGI Servlet when enableCmdLineArguments is enabled, caused by JRE bugs in passing command line arguments to Windows shells. The vulnerability is NOT PRESENT in this target (Tomcat 9.0.83) because the upstream fix was already included in the Apache Tomcat 9.0.83 release that TuxCare onboarded. The fix (commit 4b244d827ade2a36ef3b8734939541207b78f35c, authored by Mark Thomas markt@apache.org on April 3, 2019) adds validation of decoded command line arguments against a restrictive pattern that blocks special shell characters required for command injection. On Windows, the pattern restricts arguments to [\\\\w\\\\Q-.\\\\/:\\\\E]+, preventing injection of characters like &, |, ;, <, >, etc. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "impact_statement": "CVE-2019-0232 describes a Windows-specific Remote Code Execution vulnerability in Tomcat's CGI Servlet when enableCmdLineArguments is enabled, caused by JRE bugs in passing command line arguments to Windows shells. The vulnerability is NOT PRESENT in this target (Tomcat 9.0.83) because the upstream fix was already included in the Apache Tomcat 9.0.83 release that TuxCare onboarded. The fix (commit 4b244d827ade2a36ef3b8734939541207b78f35c, authored by Mark Thomas markt@apache.org on April 3, 2019) adds validation of decoded command line arguments against a restrictive pattern that blocks special shell characters required for command injection. On Windows, the pattern restricts arguments to [\\\\w\\\\Q-.\\\\/:\\\\E]+, preventing injection of characters like &, |, ;, <, >, etc. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.17; >= 8.0.0, < 8.5.40; >= 7.0.0, < 7.0.94), NVD (>= 7.0.0, <= 7.0.93; >= 8.5.0, <= 8.5.39; >= 9.0.1, <= 9.0.17; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.17; >= 8.5.0, <= 8.5.39; >= 7.0.0, <= 7.0.93), Snyk (>= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18; >= 7.0.0, < 7.0.94; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2019-10072 affects Apache Tomcat 9.0.0.M1 to 9.0.19 via HTTP/2 connection window exhaustion when clients don't send WINDOW_UPDATE messages for stream 0. The target version 9.0.83 contains the upstream fix (commit 7f748eb6bf, 2019-04-30) authored by markt@apache.org, which adds timeout handling to connection window allocation. When the connection window is exhausted, the server now waits with a configurable timeout (default 5000ms) and closes the connection if no allocation is granted within the timeout period. This fix was already present in the upstream release when TuxCare onboarded version 9.0.83 in August 2025, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "impact_statement": "CVE-2019-10072 affects Apache Tomcat 9.0.0.M1 to 9.0.19 via HTTP/2 connection window exhaustion when clients don't send WINDOW_UPDATE messages for stream 0. The target version 9.0.83 contains the upstream fix (commit 7f748eb6bf, 2019-04-30) authored by markt@apache.org, which adds timeout handling to connection window allocation. When the connection window is exhausted, the server now waits with a configurable timeout (default 5000ms) and closes the connection if no allocation is granted within the timeout period. This fix was already present in the upstream release when TuxCare onboarded version 9.0.83 in August 2025, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.41), NVD (>= 8.5.0, <= 8.5.40; >= 9.0.1, <= 9.0.19; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.19; >= 8.5.0, <= 8.5.40), Snyk (>= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20; >= 8.5.0, < 8.5.40; >= 9.0.0.M1, < 9.0.20)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The JmxRemoteLifecycleListener feature, which contained the CVE-2019-12418 vulnerability, was completely removed from Apache Tomcat by upstream maintainer Mark Thomas in commit 510520cf49 on January 11, 2022. This removal was already present in the upstream Tomcat 9.0.83 release that TuxCare onboarded, making the target version 9.0.83 not affected by this vulnerability. The vulnerable code path does not exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "impact_statement": "The JmxRemoteLifecycleListener feature, which contained the CVE-2019-12418 vulnerability, was completely removed from Apache Tomcat by upstream maintainer Mark Thomas in commit 510520cf49 on January 11, 2022. This removal was already present in the upstream Tomcat 9.0.83 release that TuxCare onboarded, making the target version 9.0.83 not affected by this vulnerability. The vulnerable code path does not exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.49; >= 9.0.0, < 9.0.29), NVD (>= 7.0.0, <= 7.0.97; >= 8.5.0, <= 8.5.47; >= 9.0.0, <= 9.0.28), cve.org (>= 9.0.0.M1, <= 9.0.28; >= 8.5.0, <= 8.5.47; >= 7.0.0, <= 7.0.97), Snyk (>= 9.0.16, < 9.0.29; >= 9.0.16, < 9.0.29)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target version 9.0.83 is not affected by CVE-2019-17563 (session fixation in FORM authentication). The vulnerability affected Tomcat 9.0.0.M1 to 9.0.29; the target is version 9.0.83, which is after the affected range. The upstream fix (commit 1ecba14e690cf5f3f143eef6ae7037a6d3c16652 by Mark Thomas) was already included in the upstream 9.0.30+ releases before TuxCare onboarded this version. The fix reorders authentication operations to call register() immediately after successful authentication, ensuring session ID regeneration happens before the authenticated session can be used, preventing session fixation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "impact_statement": "Target version 9.0.83 is not affected by CVE-2019-17563 (session fixation in FORM authentication). The vulnerability affected Tomcat 9.0.0.M1 to 9.0.29; the target is version 9.0.83, which is after the affected range. The upstream fix (commit 1ecba14e690cf5f3f143eef6ae7037a6d3c16652 by Mark Thomas) was already included in the upstream 9.0.30+ releases before TuxCare onboarded this version. The fix reorders authentication operations to call register() immediately after successful authentication, ensuring session ID regeneration happens before the authenticated session can be used, preventing session fixation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.0.99; >= 8.0.0, < 8.5.50; >= 9.0.0, < 9.0.30), NVD (>= 7.0.0, <= 7.0.98; >= 8.5.0, <= 8.5.49; >= 9.0.0, <= 9.0.29), cve.org (>= 9.0.0.M1, <= 9.0.29; >= 8.5.0, <= 8.5.49; >= 7.0.0, <= 7.0.98), Snyk (>= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99; >= 9.0.0.M1, < 9.0.30; >= 8.5.0, < 8.5.50; < 7.0.99)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:56.766712+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2019-17569 affected Apache Tomcat versions 9.0.28-9.0.30 due to a regression in Transfer-Encoding header parsing. The target version 9.0.83 (released November 2023) is NOT affected because the upstream fix was applied in December 2019, nearly 4 years before this version was released. The fix properly rejects invalid Transfer-Encoding headers instead of silently ignoring them, preventing HTT...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 affected Apache Tomcat versions 9.0.28-9.0.30 due to a regression in Transfer-Encoding header parsing. The target version 9.0.83 (released November 2023) is NOT affected because the upstream fix was applied in December 2019, nearly 4 years before this version was released. The fix properly rejects invalid Transfer-Encoding headers instead of silently ignoring them, preventing HTT..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.83 is not affected by CVE-2020-11996. The vulnerability (high CPU usage from inefficient iteration over large HTTP/2 stream ID gaps) was fixed upstream in commit 9a0231683a, Fix BZ 64467 Improve performance of closing idle streams, which shipped in Tomcat 9.0.36 in June 2020. The target version 9.0.83 naturally includes this upstream vendor fix. The vulnerable sequential iteration through stream IDs has been replaced with an optimized ConcurrentNavigableMap.subMap() approach in Http2UpgradeHandler.closeIdleStreams that only iterates over actually-existing streams, preventing CPU exhaustion attacks. The CVE affected versions 9.0.0.M1 to 9.0.35; version 9.0.83 is well beyond the affected range.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Apache Tomcat 9.0.83 is not affected by CVE-2020-11996. The vulnerability (high CPU usage from inefficient iteration over large HTTP/2 stream ID gaps) was fixed upstream in commit 9a0231683a, Fix BZ 64467 Improve performance of closing idle streams, which shipped in Tomcat 9.0.36 in June 2020. The target version 9.0.83 naturally includes this upstream vendor fix. The vulnerable sequential iteration through stream IDs has been replaced with an optimized ConcurrentNavigableMap.subMap() approach in Http2UpgradeHandler.closeIdleStreams that only iterates over actually-existing streams, preventing CPU exhaustion attacks. The CVE affected versions 9.0.0.M1 to 9.0.35; version 9.0.83 is well beyond the affected range."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2020-1935 is NOT present in Tomcat 9.0.83. The vulnerability was fixed in upstream Apache Tomcat 9.0.31 (commit 8bfb0ff7f25fe7555a5eb2f7984f73546c11aa26 by Mark Thomas) and this fix was included in the upstream 9.0.83 release that TuxCare onboarded. The target contains the complete fix: strict CRLF validation (requiring CR to be followed by LF) and control character rejection (except TAB) i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1935 is NOT present in Tomcat 9.0.83. The vulnerability was fixed in upstream Apache Tomcat 9.0.31 (commit 8bfb0ff7f25fe7555a5eb2f7984f73546c11aa26 by Mark Thomas) and this fix was included in the upstream 9.0.83 release that TuxCare onboarded. The target contains the complete fix: strict CRLF validation (requiring CR to be followed by LF) and control character rejection (except TAB) i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2020-1938 (Ghostcat) is NOT present in target Tomcat 9.0.83. All three upstream security fixes (loopback binding, secret authentication, request attribute filtering) shipped in the upstream release. The vulnerable pattern does not exist in this version. AJP connector is also disabled by default in the configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "impact_statement": "CVE-2020-1938 (Ghostcat) is NOT present in target Tomcat 9.0.83. All three upstream security fixes (loopback binding, secret authentication, request attribute filtering) shipped in the upstream release. The vulnerable pattern does not exist in this version. AJP connector is also disabled by default in the configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; >= 7.0.0, < 7.0.100), NVD (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), cve.org (>= 9.0.0.M1, <= 9.0.0.30; >= 8.5.0, <= 8.5.50; >= 7.0.0, <= 7.0.99), Snyk (>= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; >= 9.0.0, < 9.0.31; >= 8.0.0, < 8.5.51; < 7.0.100; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.83 is not affected by CVE-2020-9484. The vulnerability (path traversal in session ID allowing arbitrary file deserialization) was fixed by upstream Apache in commit 3aa8f28db7e (Mark Thomas, May 2020) before version 9.0.83 was released. The fix validates that session file paths remain within the storage directory using canonical path comparison. CVE-2020-9484 affected versions 9.0.0.M1 to 9.0.34; version 9.0.83 was released later with the fix already present in the upstream codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Apache Tomcat 9.0.83 is not affected by CVE-2020-9484. The vulnerability (path traversal in session ID allowing arbitrary file deserialization) was fixed by upstream Apache in commit 3aa8f28db7e (Mark Thomas, May 2020) before version 9.0.83 was released. The fix validates that session file paths remain within the storage directory using canonical path comparison. CVE-2020-9484 affected versions 9.0.0.M1 to 9.0.34; version 9.0.83 was released later with the fix already present in the upstream codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 9.0.0.M1-9.0.39"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2021-25122 is not present in Tomcat 9.0.83-tuxcare.6. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.41 and involved shared mutable state in h2c connection handling causing cross-request data leakage. All three upstream fixes (HpackDecoder concurrency fix, ConnectionSettingsBase thread-safe collections, and AbstractProtocol processor lifecycle management) were committed by Mark Thomas (markt@apache.org) and shipped in upstream Tomcat 9.0.83 before TuxCare onboarded this version. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "impact_statement": "CVE-2021-25122 is not present in Tomcat 9.0.83-tuxcare.6. The vulnerability affected Tomcat 9.0.0.M1 to 9.0.41 and involved shared mutable state in h2c connection handling causing cross-request data leakage. All three upstream fixes (HpackDecoder concurrency fix, ConnectionSettingsBase thread-safe collections, and AbstractProtocol processor lifecycle management) were committed by Mark Thomas (markt@apache.org) and shipped in upstream Tomcat 9.0.83 before TuxCare onboarded this version. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.83 is not affected by CVE-2021-25329. This vulnerability involved incomplete path traversal validation where String-based canonical path prefix checking could be bypassed in edge cases. The upstream fix (commit 4785433a226 by Mark Thomas, 2021-01-20) replaced vulnerable `getCanonicalPath().startsWith()` checks with filesystem-aware `Path.startsWith()` in all five affected files (FileStore, DefaultServlet, ExpandWar, HostConfig, ContextConfig). This fix was already present in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded, predating any TuxCare modifications to this branch. The vulnerable pattern does not exist in the target; all directory containment checks use the secure Path-based approach.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "impact_statement": "Apache Tomcat 9.0.83 is not affected by CVE-2021-25329. This vulnerability involved incomplete path traversal validation where String-based canonical path prefix checking could be bypassed in edge cases. The upstream fix (commit 4785433a226 by Mark Thomas, 2021-01-20) replaced vulnerable `getCanonicalPath().startsWith()` checks with filesystem-aware `Path.startsWith()` in all five affected files (FileStore, DefaultServlet, ExpandWar, HostConfig, ContextConfig). This fix was already present in the upstream Apache Tomcat 9.0.83 release that TuxCare onboarded, predating any TuxCare modifications to this branch. The vulnerable pattern does not exist in the target; all directory containment checks use the secure Path-based approach.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0, < 9.0.41; >= 8.0.0, < 8.5.61; >= 7.0.0, < 7.0.108), NVD (>= 7.0.0, <= 7.0.107; >= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.0; >= 9, < 9.0.41; >= 8.5, < 8.5.61; >= 7, < 7.0.107), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 7.0.0, < 7.0.108)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target Apache Tomcat 9.0.83 is not affected by CVE-2022-42252. The vulnerability (accepting malformed Content-Length headers when rejectIllegalHeader=false, enabling request smuggling) was fixed by upstream Apache in commit 4c7f4fd09d, which is present in the 9.0.83 release. The CVE affects versions 9.0.0-M1 to 9.0.67; version 9.0.83 is beyond this range and contains the upstream fix. The fix forces rejection of all malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting, as required by RFC 9112 section 6.3 bullet 5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "Target Apache Tomcat 9.0.83 is not affected by CVE-2022-42252. The vulnerability (accepting malformed Content-Length headers when rejectIllegalHeader=false, enabling request smuggling) was fixed by upstream Apache in commit 4c7f4fd09d, which is present in the 9.0.83 release. The CVE affects versions 9.0.0-M1 to 9.0.67; version 9.0.83 is beyond this range and contains the upstream fix. The fix forces rejection of all malformed Content-Length headers regardless of the rejectIllegalHeader configuration setting, as required by RFC 9112 section 6.3 bullet 5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.83; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1), NVD (>= 8.5.0, < 8.5.83; >= 9.0.0, < 9.0.68; >= 10.0.0, < 10.0.27; >= 10.1.0, < 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.0; >= 10.0.0-M1, <= 10.0.26; >= 9.0.0-M1, <= 9.0.67; >= 8.5.0, <= 8.5.82), Snyk (>= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1; >= 8.5.0, < 8.5.53; >= 9.0.0-M1, < 9.0.68; >= 10.0.0-M1, < 10.0.27; >= 10.1.0-M1, < 10.1.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.83 is not affected by CVE-2022-45143. The upstream Apache fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) was already present in the upstream 9.0.83 release, which serves as the base for this TuxCare branch. The JsonErrorReportValve properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing the JSON injection vulnerability. The CVE affects versions 9.0.40 to 9.0.68; this version (9.0.83) is outside the affected range.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Apache Tomcat 9.0.83 is not affected by CVE-2022-45143. The upstream Apache fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) was already present in the upstream 9.0.83 release, which serves as the base for this TuxCare branch. The JsonErrorReportValve properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing the JSON injection vulnerability. The CVE affects versions 9.0.40 to 9.0.68; this version (9.0.83) is outside the affected range."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:41:21.668205+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.83 is not affected by CVE-2023-24998. The fix for unlimited file upload parts (DoS vulnerability) was already present in the upstream Apache Tomcat 9.0.83 release. The fix adds fileCountMax limiting in FileUploadBase and wires it through Request.java to enforce maxParameterCount (default: 10,000). The vulnerable code pattern (unbounded iteration over multipart parts) is not present because the upstream fix (commit cf77cc545d by markt@apache.org, Dec 2022) was included in the 9.0.83 release (Nov 2023) before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "impact_statement": "Apache Tomcat 9.0.83 is not affected by CVE-2023-24998. The fix for unlimited file upload parts (DoS vulnerability) was already present in the upstream Apache Tomcat 9.0.83 release. The fix adds fileCountMax limiting in FileUploadBase and wires it through Request.java to enforce maxParameterCount (default: 10,000). The vulnerable code pattern (unbounded iteration over multipart parts) is not present because the upstream fix (commit cf77cc545d by markt@apache.org, Dec 2022) was included in the 9.0.83 release (Nov 2023) before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2023-28709 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Target is not affected by CVE-2023-28709. The vulnerability is an off-by-one error in parameter count limit enforcement that allows exactly one parameter beyond the configured maxParameterCount. The upstream Apache Tomcat 9.0.83 release already contains the fix (commit fbd8142162 by Mark Thomas, April 11, 2023), which reorders the limit check to occur before incrementing the counter and changes the comparison from `>` to `>=`. This fix was shipped in the upstream release before TuxCare onboarded version 9.0.83.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28709"
      },
      "impact_statement": "Target is not affected by CVE-2023-28709. The vulnerability is an off-by-one error in parameter count limit enforcement that allows exactly one parameter beyond the configured maxParameterCount. The upstream Apache Tomcat 9.0.83 release already contains the fix (commit fbd8142162 by Mark Thomas, April 11, 2023), which reorders the limit check to occur before incrementing the counter and changes the comparison from `>` to `>=`. This fix was shipped in the upstream release before TuxCare onboarded version 9.0.83.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M2, < 11.0.0-M5; >= 10.1.5, < 10.1.8; >= 9.0.71, < 9.0.74; >= 8.5.85, < 8.5.88), NVD (>= 8.5.85, <= 8.5.87; >= 9.0.71, <= 9.0.73; >= 10.1.5, <= 10.1.7; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4), cve.org (>= 11.0.0-M2, <= 11.0.0-M4; >= 10.1.5, <= 10.1.7; >= 9.0.71, <= 9.0.73; >= 8.5.85, <= 8.5.87), Snyk (>= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.71, < 9.0.74; >= 10.1.5, < 10.1.8; >= 11.0.0-M2, < 11.0.0-M5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2023-34981 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. The target (Tomcat 9.0.83) is not affected by CVE-2023-34981. The vulnerability was a regression in bug 66512's fix that caused AJP SEND_HEADERS messages to be skipped when responses had zero HTTP headers, leading to header reuse from previous requests. This regression was fixed in upstream commit 2f0ca23784 (bug 66591) which shipped in Tomcat 9.0.75. Since the target is version 9.0.83, the fix was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34981"
      },
      "impact_statement": "The target (Tomcat 9.0.83) is not affected by CVE-2023-34981. The vulnerability was a regression in bug 66512's fix that caused AJP SEND_HEADERS messages to be skipped when responses had zero HTTP headers, leading to header reuse from previous requests. This regression was fixed in upstream commit 2f0ca23784 (bug 66591) which shipped in Tomcat 9.0.75. Since the target is version 9.0.83, the fix was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M5, < 11.0.0-M6; >= 10.1.8, < 10.1.9; >= 9.0.74, < 9.0.75; >= 8.5.88, < 8.5.89), NVD (= 8.5.88; = 9.0.74; = 10.1.8; = 11.0.0-milestone5), cve.org (= 11.0.0-M5; = 10.1.8; = 9.0.74; = 8.5.88; = 10.1.8; = 11.0.0; = 8.5.88; = 9.0.74), Snyk (>= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6; >= 8.5.88, < 8.5.89; >= 9.0.74, < 9.0.75; >= 10.1.8, < 10.1.9; >= 11.0.0-M5, < 11.0.0-M6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T00:54:00.090269+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-41080 (open redirect in FORM authentication) is NOT present in the target. The vulnerability was already fixed in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The fix commit 77c0ce2d16 by Mark Thomas (markt@apache.org) was applied on 2023-08-22, before the 9.0.83 release tag on 2023-11-09. The fix is present at FormAuthenticator.java:761-764, which s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect in FORM authentication) is NOT present in the target. The vulnerability was already fixed in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The fix commit 77c0ce2d16 by Mark Thomas (markt@apache.org) was applied on 2023-08-22, before the 9.0.83 release tag on 2023-11-09. The fix is present at FormAuthenticator.java:761-764, which s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:26:26.333782+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 9.0.83 is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset). The fix for this vulnerability was included in the upstream Apache Tomcat 9.0.83 release and was present when TuxCare onboarded this version. The fix implements rate-limiting for HTTP/2 RST_STREAM frames using an overhead counter with a configurable reset factor (default 50), preventing attackers from exhausting server resources through rapid stream creation and cancellation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Apache Tomcat 9.0.83 is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset). The fix for this vulnerability was included in the upstream Apache Tomcat 9.0.83 release and was present when TuxCare onboarded this version. The fix implements rate-limiting for HTTP/2 RST_STREAM frames using an overhead counter with a configurable reset factor (default 50), preventing attackers from exhausting server resources through rapid stream creation and cancellation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94; >= 11.0.0-M1, < 11.0.0-M12; >= 10.0.0, < 10.1.14; >= 9.0.0, < 9.0.81; >= 8.5.0, < 8.5.94), NVD (>= 8.5.0, <= 8.5.93; >= 9.0.0, <= 9.0.80; >= 10.1.0, <= 10.1.13; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), Snyk (< 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12; < 8.5.94; >= 9.0.0, < 9.0.81; >= 10.0.0, < 10.1.14; >= 11.0.0-M3, < 11.0.0-M12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T19:10:05.488784+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:00.069704+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2023-46589 is not present in target Tomcat 9.0.83. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which adds character validation for trailer header names and values in ChunkedInputFilter.java, was included in the upstream Apache Tomcat 9.0.83 release (November 2023) via commit 59583245639d by Mark Thomas. The target repository is based on this upstream release and inherits the fix. The vulnerable code pattern (missing validation) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "impact_statement": "CVE-2023-46589 is not present in target Tomcat 9.0.83. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which adds character validation for trailer header names and values in ChunkedInputFilter.java, was included in the upstream Apache Tomcat 9.0.83 release (November 2023) via commit 59583245639d by Mark Thomas. The target repository is based on this upstream release and inherits the fix. The vulnerable code pattern (missing validation) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:44:00.098481+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11-9.0.43, fixed in 8.5.64+ and 9.0.44+. The target is Tomcat 9.0.83-tuxcare.6, which is well above the fixed version threshold. Both upstream fix commits (ErrorReportValve IS_IO_ALLOWED checks and Http11InputBuffer try-finally buffer state protection) are present in HEAD and were shipped in the upstream Apache Tomcat release, not add...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11-9.0.43, fixed in 8.5.64+ and 9.0.44+. The target is Tomcat 9.0.83-tuxcare.6, which is well above the fixed version threshold. Both upstream fix commits (ErrorReportValve IS_IO_ALLOWED checks and Http11InputBuffer try-finally buffer state protection) are present in HEAD and were shipped in the upstream Apache Tomcat release, not add..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2024-52317 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Version 9.0.83 is NOT affected by CVE-2024-52317. The vulnerability was introduced in version 9.0.92 (July 24, 2024) when commit 3c5b14b713 added HTTP/2 request/response recycling and reuse functionality. Version 9.0.83 predates this feature and does not recycle/reuse request/response objects between streams, so the attack chain leading to data mix-up between users does not exist. The CVE's sta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52317"
      },
      "impact_statement": "not_affected \u2014 Version 9.0.83 is NOT affected by CVE-2024-52317. The vulnerability was introduced in version 9.0.92 (July 24, 2024) when commit 3c5b14b713 added HTTP/2 request/response recycling and reuse functionality. Version 9.0.83 predates this feature and does not recycle/reuse request/response objects between streams, so the attack chain leading to data mix-up between users does not exist. The CVE's sta..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:46:09.756674+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:46:09.756674+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-22T14:18:08.466710+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:27:37.057480+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Target version 9.0.83 is NOT AFFECTED by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved due to using HashSet instead of LinkedHashSet when merging TLS 1.3 cipher suites with regular ciphers. However, version 9.0.83 does not contain the vulnerable code pattern because TLS 1.3 cipher suite merging functionality was introduced after this version, around 9.0....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.83 is NOT AFFECTED by CVE-2026-29129. The vulnerability involves cipher preference order not being preserved due to using HashSet instead of LinkedHashSet when merging TLS 1.3 cipher suites with regular ciphers. However, version 9.0.83 does not contain the vulnerable code pattern because TLS 1.3 cipher suite merging functionality was introduced after this version, around 9.0...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:46:09.756674+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:46:09.756674+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:25.894192+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-65637"
      },
      "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:46:09.756674+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core, and is fixed in 9.0.83-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.83-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.83-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 9.0.83-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-r53m-pfr5-7v87"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}