{
  "@id": "urn:uuid:f793d339-d952-4b35-bc6e-ea89352f98fd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:20:30.171913+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2016-8745 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat-util. CVE-2016-8745 is not present in Tomcat 9.0.100. The vulnerability involved error handling in NioEndpoint.processSendfile() that would call cancelledKey(sk) when calledByProcessor was true, causing Processors to be added to the cache multiple times and enabling concurrent request sharing with information leakage. The upstream fix (commit cbc9b18a84 by violetagg@apache.org) removed the else clause calling cancelledKey in error handlers, ensuring it's only called when !calledByProcessor. This fix was already shipped in the upstream 9.0.100 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M14; >= 8.5.0, < 8.5.9; >= 8.0.0-RC1, < 8.0.41; >= 7.0.0, < 7.0.75; >= 6.0.16, < 6.0.50), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 8.0; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M13; >= 8.5.0, <= 8.5.8; >= 8.0.0.RC1, <= 8.0.39; >= 7.0.0, <= 7.0.73; >= 6.0.16, <= 6.0.48), Snyk (<= 0; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8745"
      },
      "impact_statement": "CVE-2016-8745 is not present in Tomcat 9.0.100. The vulnerability involved error handling in NioEndpoint.processSendfile() that would call cancelledKey(sk) when calledByProcessor was true, causing Processors to be added to the cache multiple times and enabling concurrent request sharing with information leakage. The upstream fix (commit cbc9b18a84 by violetagg@apache.org) removed the else clause calling cancelledKey in error handlers, ensuring it's only called when !calledByProcessor. This fix was already shipped in the upstream 9.0.100 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M14; >= 8.5.0, < 8.5.9; >= 8.0.0-RC1, < 8.0.41; >= 7.0.0, < 7.0.75; >= 6.0.16, < 6.0.50), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 8.0; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M13; >= 8.5.0, <= 8.5.8; >= 8.0.0.RC1, <= 8.0.39; >= 7.0.0, <= 7.0.73; >= 6.0.16, <= 6.0.48), Snyk (<= 0; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat-util.",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "action_statement": "Vulnerability CVE-2022-45143 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat-util."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:23:53.811682+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat-util. not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.100-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T21:50:56.656209+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat-util.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 9.0.100-tuxcare.3 of org.apache.tomcat:tomcat-util."
    }
  ]
}