{
  "@id": "urn:uuid:26a1b499-8e11-4da7-8c22-74158c070bc0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:42:01.819471+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.87-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.87-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:42:01.819471+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 does not affect version 9.0.87-tuxcare.2 of org.apache.tomcat.experimental:tomcat-embed-programmatic. not_affected \u2014 CVE-2024-21733 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability affects versions 9.0.0-M11 through 9.0.43, with fixes released in 9.0.44+. The target version (9.0.87) includes upstream fixes from commits d1da266aa1 (ErrorReportValve) and ce4b154e7b (Http11InputBuffer), both authored by Mark Thomas and shipped in the upstream release. The vulnerable pattern\u2014unconditional error inform...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-21733 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability affects versions 9.0.0-M11 through 9.0.43, with fixes released in 9.0.44+. The target version (9.0.87) includes upstream fixes from commits d1da266aa1 (ErrorReportValve) and ce4b154e7b (Http11InputBuffer), both authored by Mark Thomas and shipped in the upstream release. The vulnerable pattern\u2014unconditional error inform..."
    }
  ]
}