{
  "@id": "urn:uuid:75a477d3-c66f-4a5f-8715-eb9c7934f5be",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:15:51.446651+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.87-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.87-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 does not affect version 9.0.87-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-websocket. CVE-2020-13935 is not present in Tomcat 9.0.87. The vulnerability affected versions 9.0.0.M1 to 9.0.36, and the fix was included in upstream Apache Tomcat releases after 9.0.36. The target version 9.0.87 shipped with the fix already applied by the upstream vendor (Mark Thomas, markt@apache.org) in commit 40fa74c74822711ab878079d0a69f7357926723d dated 2020-06-29. The fix adds validation in WsFrameBase.java to reject WebSocket frames with negative payload lengths (MSB set in 64-bit extended length field), preventing the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "impact_statement": "CVE-2020-13935 is not present in Tomcat 9.0.87. The vulnerability affected versions 9.0.0.M1 to 9.0.36, and the fix was included in upstream Apache Tomcat releases after 9.0.36. The target version 9.0.87 shipped with the fix already applied by the upstream vendor (Mark Thomas, markt@apache.org) in commit 40fa74c74822711ab878079d0a69f7357926723d dated 2020-06-29. The fix adds validation in WsFrameBase.java to reject WebSocket frames with negative payload lengths (MSB set in 64-bit extended length field), preventing the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.87-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.87-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-23672 does not affect version 9.0.87-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Target Tomcat 9.0.87-tuxcare.6 is NOT affected by CVE-2024-23672. The vulnerability (incomplete cleanup of WebSocket sessions when clients fail to respond to server close messages) was fixed in upstream Apache Tomcat 9.0.86. The fix (commit 52d6650e06 by Mark Thomas) was already included in the upstream 9.0.87 release upon which the TuxCare 9.0.87-tuxcare.X branch series is based. The current H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-23672"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 9.0.87-tuxcare.6 is NOT affected by CVE-2024-23672. The vulnerability (incomplete cleanup of WebSocket sessions when clients fail to respond to server close messages) was fixed in upstream Apache Tomcat 9.0.86. The fix (commit 52d6650e06 by Mark Thomas) was already included in the upstream 9.0.87 release upon which the TuxCare 9.0.87-tuxcare.X branch series is based. The current H..."
    }
  ]
}