{
  "@id": "urn:uuid:0182f430-e0ad-41c3-a666-4d9738911bd3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 60,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:42:00.103673+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 (XSS in host-manager) is not present in Apache Tomcat 9.0.90. The fix was already included in the upstream release that TuxCare onboarded. Commit 49c71fc59c (authored by Mark Thomas from Apache on June 2, 2008) added HTML escaping to prevent XSS injection via the hostname parameter to host-manager/html/add. The current code uses Escape.htmlElementContent() to escape all user-suppl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-1947 (XSS in host-manager) is not present in Apache Tomcat 9.0.90. The fix was already included in the upstream release that TuxCare onboarded. Commit 49c71fc59c (authored by Mark Thomas from Apache on June 2, 2008) added HTML escaping to prevent XSS injection via the hostname parameter to host-manager/html/add. The current code uses Escape.htmlElementContent() to escape all user-suppl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T23:29:00.040141+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE in XML configuration parsing) is NOT present in target Tomcat 9.0.90. The upstream Apache fix that blocks external entity resolution via LocalResolver.blockExternal was already included in the upstream 9.0.90 release (commit 05c84ff8304) before TuxCare onboarded this version. The fix is authored by Mark Thomas (markt@apache.org), an Apache committer, and defaults to enabled (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4590 (XXE in XML configuration parsing) is NOT present in target Tomcat 9.0.90. The upstream Apache fix that blocks external entity resolution via LocalResolver.blockExternal was already included in the upstream 9.0.90 release (commit 05c84ff8304) before TuxCare onboarded this version. The fix is authored by Mark Thomas (markt@apache.org), an Apache committer, and defaults to enabled (..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T23:23:31.441488+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 directory traversal vulnerability is NOT present in target version 9.0.90. The upstream Apache Tomcat project fixed this vulnerability in April 2016 (commit 47ecd0d0f9) by adding the addedTrailingSlash defense mechanism, which ensures paths ending with /.  or /.. are normalized to /./ or /../ before validation. This fix was already present in the upstream release 9.0.90 when TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-5174 directory traversal vulnerability is NOT present in target version 9.0.90. The upstream Apache Tomcat project fixed this vulnerability in April 2016 (commit 47ecd0d0f9) by adding the addedTrailingSlash defense mechanism, which ensures paths ending with /.  or /.. are normalized to /./ or /../ before validation. This fix was already present in the upstream release 9.0.90 when TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:42:00.103673+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). The upstream fix was released in 9.0.0.M2, and version 9.0.90 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 04164c1f, 83679b99). The upstream fix was released in 9.0.0.M2, and version 9.0.90 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T23:23:00.048190+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 9.0.90 is not affected by CVE-2016-0706. The vulnerability affects Tomcat 9.x before 9.0.0.M2, where StatusManagerServlet was not on the restricted servlets list, allowing unprivileged web applications to load it and access HTTP request data including session IDs. The fix (adding StatusManagerServlet to RestrictedServlets.properties) was included in the upstream Apache ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.90 is not affected by CVE-2016-0706. The vulnerability affects Tomcat 9.x before 9.0.0.M2, where StatusManagerServlet was not on the restricted servlets list, allowing unprivileged web applications to load it and access HTTP request data including session IDs. The fix (adding StatusManagerServlet to RestrictedServlets.properties) was included in the upstream Apache ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T10:45:43.570322+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 9.0.90. The fix was already included in the upstream Apache Tomcat release that TuxCare onboarded. All Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the defense code that calls `getCredentialHandler().mutate(credentials)` when a username is not found, eliminating timing differences that would...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 9.0.90. The fix was already included in the upstream Apache Tomcat release that TuxCare onboarded. All Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the defense code that calls `getCredentialHandler().mutate(credentials)` when a username is not found, eliminating timing differences that would..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T23:34:00.064817+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not present in Tomcat 9.0.90. The vulnerability affected Tomcat 9.x before 9.0.0.M3, and version 9.0.90 is significantly later. The upstream fix (commit 76ebc9007567c8326217dd94844540e1e27d8468 by kkolinko@apache.org) adding SecurityManager authorization check to setGlobalContext() was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-0763 is not present in Tomcat 9.0.90. The vulnerability affected Tomcat 9.x before 9.0.0.M3, and version 9.0.90 is significantly later. The upstream fix (commit 76ebc9007567c8326217dd94844540e1e27d8468 by kkolinko@apache.org) adding SecurityManager authorization check to setGlobalContext() was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T10:28:01.156478+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is NOT present in Tomcat 9.0.90. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the digester's property substitution feature. The upstream fix (commit c1660182010b4255c21c874d69c124370a67784a by Mark Thomas) was applied in July 2016 and was already included in the upstream Tomcat 9.0.90 release before TuxCare's ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6794 is NOT present in Tomcat 9.0.90. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the digester's property substitution feature. The upstream fix (commit c1660182010b4255c21c874d69c124370a67784a by Mark Thomas) was applied in July 2016 and was already included in the upstream Tomcat 9.0.90 release before TuxCare's ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6796 is NOT present in Tomcat 9.0.90 (target SHA 04c3fcda2a). The vulnerability allowed malicious web applications to bypass SecurityManager by manipulating JSP servlet configuration parameters (engineOptionsClass and scratchdir). The fix, which adds checks to ignore these parameters when SecurityManager is enabled, was introduced by upstream Apache Tomcat in commit f603f2f459 (author: Mark Thomas, markt@apache.org) and shipped in release 9.0.0-M10, before the first TuxCare commit bc69a880a5. Both security checks are present and correctly implemented in the target code at JspServlet.java:89-93 and EmbeddedServletOptions.java:593-596.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "impact_statement": "CVE-2016-6796 is NOT present in Tomcat 9.0.90 (target SHA 04c3fcda2a). The vulnerability allowed malicious web applications to bypass SecurityManager by manipulating JSP servlet configuration parameters (engineOptionsClass and scratchdir). The fix, which adds checks to ignore these parameters when SecurityManager is enabled, was introduced by upstream Apache Tomcat in commit f603f2f459 (author: Mark Thomas, markt@apache.org) and shipped in release 9.0.0-M10, before the first TuxCare commit bc69a880a5. Both security checks are present and correctly implemented in the target code at JspServlet.java:89-93 and EmbeddedServletOptions.java:593-596.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Apache Tomcat 9.0.90. The vulnerability allowed web applications to access any global JNDI resource without an explicit ResourceLink configuration. The upstream fix was applied by Apache committer Mark Thomas (markt@apache.org) in commit 2859ac3eae on 2016-08-22, nearly 9 years before TuxCare onboarded version 9.0.90. The fix adds a registration system that tracks which web applications have explicit ResourceLink configurations and validates access requests before allowing resource resolution. The complete defense is present in both ResourceLinkFactory.java and NamingContextListener.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "impact_statement": "CVE-2016-6797 is NOT present in Apache Tomcat 9.0.90. The vulnerability allowed web applications to access any global JNDI resource without an explicit ResourceLink configuration. The upstream fix was applied by Apache committer Mark Thomas (markt@apache.org) in commit 2859ac3eae on 2016-08-22, nearly 9 years before TuxCare onboarded version 9.0.90. The fix adds a registration system that tracks which web applications have explicit ResourceLink configurations and validates access requests before allowing resource resolution. The complete defense is present in both ResourceLinkFactory.java and NamingContextListener.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6817 (HTTP/2 infinite loop DoS) is not present in Tomcat 9.0.90. The vulnerable infinite-loop pattern was fixed in the upstream release. The target contains the vendor's fix (dynamic buffer expansion at lines 512-524 of Http2Parser.java) that prevents the infinite loop when HTTP/2 headers exceed buffer capacity. This fix shipped with Tomcat 9.0.90, which TuxCare onboarded via commit bc69a880a5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "impact_statement": "CVE-2016-6817 (HTTP/2 infinite loop DoS) is not present in Tomcat 9.0.90. The vulnerable infinite-loop pattern was fixed in the upstream release. The target contains the vendor's fix (dynamic buffer expansion at lines 512-524 of Http2Parser.java) that prevents the infinite loop when HTTP/2 headers exceed buffer capacity. This fix shipped with Tomcat 9.0.90, which TuxCare onboarded via commit bc69a880a5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 with an information disclosure vulnerability in Http11InputBuffer.java that allows data from one HTTP request to leak into another. The target is Apache Tomcat 9.0.90, which already contains the upstream fix (commit 452c8094) that was applied by Apache in December 2016. The fix corrects ByteBuffer state management in the nextRequest() method by properly calling flip() after compact() and resetting position/limit when no data remains. This fix was already present in the upstream 9.0.90 release when TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "impact_statement": "CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 with an information disclosure vulnerability in Http11InputBuffer.java that allows data from one HTTP request to leak into another. The target is Apache Tomcat 9.0.90, which already contains the upstream fix (commit 452c8094) that was applied by Apache in December 2016. The fix corrects ByteBuffer state management in the nextRequest() method by properly calling flip() after compact() and resetting position/limit when no data remains. This fix was already present in the upstream 9.0.90 release when TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 (plus earlier 8.x, 7.x, 6.x branches). The target is Tomcat 9.0.90, which is far beyond the vulnerable range. The upstream fix was applied by Mark Thomas (markt@apache.org) on March 27, 2017 in commit 864aa1199a, introducing SendfileKeepAliveState enum and logic to check for pipelined data via available() before sendfile completion. This fix was already present in the upstream Apache Tomcat 9.0.90 release when TuxCare onboarded it on November 3, 2025 (commit bc69a880a5). The vulnerable pattern (pipelined requests lost when sendfile is used) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "impact_statement": "CVE-2017-5647 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 (plus earlier 8.x, 7.x, 6.x branches). The target is Tomcat 9.0.90, which is far beyond the vulnerable range. The upstream fix was applied by Mark Thomas (markt@apache.org) on March 27, 2017 in commit 864aa1199a, introducing SendfileKeepAliveState enum and logic to check for pipelined data via available() before sendfile completion. This fix was already present in the upstream Apache Tomcat 9.0.90 release when TuxCare onboarded it on November 3, 2025 (commit bc69a880a5). The vulnerable pattern (pipelined requests lost when sendfile is used) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.90 is NOT affected by CVE-2017-5650. The vulnerability affected versions 9.0.0.M1 to 9.0.0.M18 (milestone releases from 2016-2017). The fix was applied by Apache in March 2017 via commits c909f014 and 5496e193, authored by Mark Thomas. These commits were already present in the upstream Apache Tomcat 9.0.90 release that TuxCare onboarded. The target code correctly implements all three components of the fix: (1) goaway() calls close(), (2) close() iterates through all streams and calls receiveReset() to release threads, and (3) upgradeDispatch() checks connection state. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "impact_statement": "Apache Tomcat 9.0.90 is NOT affected by CVE-2017-5650. The vulnerability affected versions 9.0.0.M1 to 9.0.0.M18 (milestone releases from 2016-2017). The fix was applied by Apache in March 2017 via commits c909f014 and 5496e193, authored by Mark Thomas. These commits were already present in the upstream Apache Tomcat 9.0.90 release that TuxCare onboarded. The target code correctly implements all three components of the fix: (1) goaway() calls close(), (2) close() iterates through all streams and calls receiveReset() to release threads, and (3) upgradeDispatch() checks connection state. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5664 is NOT present in Apache Tomcat 9.0.90. The vulnerability was fixed in upstream Apache Tomcat 9.0.0-M24 (May 2017) by commit 7d93527254, authored by Mark Thomas (markt@apache.org). This fix was already included in the Apache Tomcat 9.0.90 release that TuxCare onboarded. Both DefaultServlet and WebdavServlet contain the required defense code that checks for DispatcherType.ERROR and forces error dispatches through doGet(), preventing non-GET methods from being applied to static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "impact_statement": "CVE-2017-5664 is NOT present in Apache Tomcat 9.0.90. The vulnerability was fixed in upstream Apache Tomcat 9.0.0-M24 (May 2017) by commit 7d93527254, authored by Mark Thomas (markt@apache.org). This fix was already included in the Apache Tomcat 9.0.90 release that TuxCare onboarded. Both DefaultServlet and WebdavServlet contain the required defense code that checks for DispatcherType.ERROR and forces error dispatches through doGet(), preventing non-GET methods from being applied to static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T10:38:23.915288+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2017-7674 affects the CORS filter's missing Vary header, which could lead to cache poisoning where a cached CORS response for one origin is incorrectly served to a different origin. The upstream fix (commit b94478d45b by remm@apache.org, May 2017) was already included in Tomcat 9.0.90 before TuxCare onboarded it. The target's CorsFilter.java contains the fix at line 372, which adds \"Vary: O...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-7674 affects the CORS filter's missing Vary header, which could lead to cache poisoning where a cached CORS response for one origin is incorrectly served to a different origin. The upstream fix (commit b94478d45b by remm@apache.org, May 2017) was already included in Tomcat 9.0.90 before TuxCare onboarded it. The target's CorsFilter.java contains the fix at line 372, which adds \"Vary: O..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in Apache Tomcat 9.0.90. The vulnerability involved HTTP/2 request handling that used setString() instead of setBytes(), causing path parameters (like ;jsessionid=...) to be ignored during security constraint matching. This allowed attackers to bypass security checks by appending path parameters that were not processed. The fix (Bug 61120) was applied by upstream developer Mark Thomas in May 2017 (commit cf181edc9a) and shipped in the upstream Tomcat 9.0.90 release. The TuxCare repository was initialized from this already-fixed upstream version in November 2025. The target code at Stream.java:396-401 contains the complete fix with its original comment referencing Bug 61120.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "impact_statement": "CVE-2017-7675 is NOT present in Apache Tomcat 9.0.90. The vulnerability involved HTTP/2 request handling that used setString() instead of setBytes(), causing path parameters (like ;jsessionid=...) to be ignored during security constraint matching. This allowed attackers to bypass security checks by appending path parameters that were not processed. The fix (Bug 61120) was applied by upstream developer Mark Thomas in May 2017 (commit cf181edc9a) and shipped in the upstream Tomcat 9.0.90 release. The TuxCare repository was initialized from this already-fixed upstream version in November 2025. The target code at Stream.java:396-401 contains the complete fix with its original comment referencing Bug 61120.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 is not present in Tomcat 9.0.90. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache Tomcat in commit 15fcd166ea2c1bb79e8541b8e1a43da9c452ceea, which was already included in the Tomcat 9.0.90 release that TuxCare onboarded. The fix adds entity encoding to variable values before output by passing SSIMediator.ENCODING_ENTITY as a seco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-0221 is not present in Tomcat 9.0.90. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache Tomcat in commit 15fcd166ea2c1bb79e8541b8e1a43da9c452ceea, which was already included in the Tomcat 9.0.90 release that TuxCare onboarded. The fix adds entity encoding to variable values before output by passing SSIMediator.ENCODING_ENTITY as a seco..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:25:43.115991+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28-9.0.30 due to a regression in Transfer-Encoding header validation that enables HTTP Request Smuggling. The target version 9.0.90 is significantly newer and contains the upstream fix (commit 060ecc5eb8 by Mark Thomas, Dec 2019). The fix modified TokenList.parseTokenList() to return boolean and track invalid tokens, allowing Http11Processor.prepareInput...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17569 affects Apache Tomcat 9.0.28-9.0.30 due to a regression in Transfer-Encoding header validation that enables HTTP Request Smuggling. The target version 9.0.90 is significantly newer and contains the upstream fix (commit 060ecc5eb8 by Mark Thomas, Dec 2019). The fix modified TokenList.parseTokenList() to return boolean and track invalid tokens, allowing Http11Processor.prepareInput..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13935 affects Apache Tomcat versions that lack validation for WebSocket frame payload lengths with the most significant bit set. The target repository (Tomcat 9.0.90) contains the upstream fix committed by Mark Thomas (markt@apache.org) on 2020-06-29 in commit 40fa74c7482. This fix was already present in the Apache Tomcat 9.0.90 release when TuxCare onboarded the version (first TuxCare commit bc69a880a5 on 2024-08-15). The vulnerable pattern is not present in HEAD. Verdict: not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "impact_statement": "CVE-2020-13935 affects Apache Tomcat versions that lack validation for WebSocket frame payload lengths with the most significant bit set. The target repository (Tomcat 9.0.90) contains the upstream fix committed by Mark Thomas (markt@apache.org) on 2020-06-29 in commit 40fa74c7482. This fix was already present in the Apache Tomcat 9.0.90 release when TuxCare onboarded the version (first TuxCare commit bc69a880a5 on 2024-08-15). The vulnerable pattern is not present in HEAD. Verdict: not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 9.0.90 is not affected by CVE-2020-1935. The vulnerability affected versions 9.0.0.M1 to 9.0.30, and the fix was applied by upstream Apache in commit 8bfb0ff7f2 on 2020-02-04, more than 4 years before Tomcat 9.0.90 was released (2024-06-14). The fix was already included in the upstream release when TuxCare onboarded this version. All fix components are present: strict CRLF parsing, heade...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "impact_statement": "not_affected \u2014 Tomcat 9.0.90 is not affected by CVE-2020-1935. The vulnerability affected versions 9.0.0.M1 to 9.0.30, and the fix was applied by upstream Apache in commit 8bfb0ff7f2 on 2020-02-04, more than 4 years before Tomcat 9.0.90 was released (2024-06-14). The fix was already included in the upstream release when TuxCare onboarded this version. All fix components are present: strict CRLF parsing, heade..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.90-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2021-30639 is not present in Apache Tomcat 9.0.90. The vulnerability involved the errorException field not being reset in the Request.recycle() method, causing all future requests handled by the same Request object to fail after a non-blocking I/O error. The fix (adding 'errorException = null;' at line 765 in Request.java) was applied by upstream Apache committer Mark Thomas in commit 8ece47c4a9 on March 24, 2021. This fix was already present in the upstream Apache Tomcat 9.0.90 release that TuxCare onboarded in November 2025, making the target repository not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "impact_statement": "CVE-2021-30639 is not present in Apache Tomcat 9.0.90. The vulnerability involved the errorException field not being reset in the Request.recycle() method, causing all future requests handled by the same Request object to fail after a non-blocking I/O error. The fix (adding 'errorException = null;' at line 765 in Request.java) was applied by upstream Apache committer Mark Thomas in commit 8ece47c4a9 on March 24, 2021. This fix was already present in the upstream Apache Tomcat 9.0.90 release that TuxCare onboarded in November 2025, making the target repository not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:41:00.083121+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 9.0.0.M1 to 9.0.45 due to missing LDAP special character escaping in JNDIRealm, allowing authentication bypass via username variations. The target version 9.0.90 is NOT affected - the upstream vendor (Apache) fixed this vulnerability in version 9.0.46 (commit c4df8d44a9, April 2021) by adding doAttributeValueEscaping() and doFilterEscaping() methods. This fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-30640 affects Apache Tomcat 9.0.0.M1 to 9.0.45 due to missing LDAP special character escaping in JNDIRealm, allowing authentication bypass via username variations. The target version 9.0.90 is NOT affected - the upstream vendor (Apache) fixed this vulnerability in version 9.0.46 (commit c4df8d44a9, April 2021) by adding doAttributeValueEscaping() and doFilterEscaping() methods. This fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T04:34:00.136956+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target Tomcat 9.0.90 is not affected by CVE-2021-33037. All three required fixes from the upstream Apache Tomcat project are present in the codebase: (1) Transfer-Encoding header processing for HTTP/1.0 clients, (2) rejection of \"identity\" encoding with 501 status, and (3) validation that chunked encoding is the final encoding in the list. These fixes were included in the upstream Tomcat 9.0.90...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 9.0.90 is not affected by CVE-2021-33037. All three required fixes from the upstream Apache Tomcat project are present in the codebase: (1) Transfer-Encoding header processing for HTTP/1.0 clients, (2) rejection of \"identity\" encoding with 501 status, and (3) validation that chunked encoding is the final encoding in the list. These fixes were included in the upstream Tomcat 9.0.90..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2021-41079 is not present in target Tomcat 9.0.90. Both upstream fixes preventing infinite loops in OpenSSLEngine.unwrap() are present: (1) idx==endOffset check at lines 594-597 throws IllegalStateException when destination buffers are exhausted but pendingApp>0, (2) bytesRead==0 check at lines 618-622 throws IllegalStateException when data is reported available but read returns zero. These fixes were authored by Apache Tomcat committers (remm@apache.org commit 95ceaf7b, markt@apache.org commit d4b340fa) in Jan-Mar 2021 and were already included in the upstream 9.0.90 release that TuxCare onboarded (setup commit bc69a880 by ikashchyeyev@cloudlinux.com). The vulnerable pattern (breaking inner loop on bytesRead==0, allowing outer loop to continue infinitely) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "impact_statement": "CVE-2021-41079 is not present in target Tomcat 9.0.90. Both upstream fixes preventing infinite loops in OpenSSLEngine.unwrap() are present: (1) idx==endOffset check at lines 594-597 throws IllegalStateException when destination buffers are exhausted but pendingApp>0, (2) bytesRead==0 check at lines 618-622 throws IllegalStateException when data is reported available but read returns zero. These fixes were authored by Apache Tomcat committers (remm@apache.org commit 95ceaf7b, markt@apache.org commit d4b340fa) in Jan-Mar 2021 and were already included in the upstream 9.0.90 release that TuxCare onboarded (setup commit bc69a880 by ikashchyeyev@cloudlinux.com). The vulnerable pattern (breaking inner loop on bytesRead==0, allowing outer loop to continue infinitely) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', a37a6d312c 'Fix BZ 68884 - improve handling of large scale WebSocket disconnects')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', a37a6d312c 'Fix BZ 68884 - improve handling of large scale WebSocket disconnects')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T01:37:00.099833+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 does not affect Apache Tomcat 9.0.90. The vulnerability was a concurrency bug where client connections could share an Http11Processor instance, causing responses to be delivered to the wrong client. The fix (atomic processor ownership management via takeCurrentProcessor()) was introduced by Apache in version 9.0.61 (commit 170e0f792bd1) and is present in the upstream 9.0.90 relea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 does not affect Apache Tomcat 9.0.90. The vulnerability was a concurrency bug where client connections could share an Http11Processor instance, causing responses to be delivered to the wrong client. The fix (atomic processor ownership management via takeCurrentProcessor()) was introduced by Apache in version 9.0.61 (commit 170e0f792bd1) and is present in the upstream 9.0.90 relea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:40.381958+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.90 is not affected by CVE-2022-23181. The TOCTOU vulnerability in FileStore's session persistence was fixed by upstream Apache in commit 1385c624b4 (January 2022) and shipped in the 9.0.90 release that TuxCare onboarded. The fix eliminates the time-of-check-time-of-use race by storing the canonical file path once and using that same resolved path for both validation and subsequent operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "impact_statement": "Apache Tomcat 9.0.90 is not affected by CVE-2022-23181. The TOCTOU vulnerability in FileStore's session persistence was fixed by upstream Apache in commit 1385c624b4 (January 2022) and shipped in the 9.0.90 release that TuxCare onboarded. The fix eliminates the time-of-check-time-of-use race by storing the canonical file path once and using that same resolved path for both validation and subsequent operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2022-25762 affects Apache Tomcat 9.0.0.M1 to 9.0.20. The target version 9.0.90 is well after the affected range. The vulnerability was fixed in upstream Apache Tomcat 9.0.21 (May 2019) through commits that introduced the CLOSED_NIO_CHANNEL pattern to prevent double-pooling of socket objects during concurrent WebSocket send/close operations. All fix commits (c2d6278b33, e2d5a040b9, 7046644bf3, 339b40bc07, 65fb1ee548) are present in the target and were authored by upstream Apache committers (remm@apache.org, markt@apache.org). The fixes were already in the upstream release when TuxCare onboarded version 9.0.90 in November 2025. The vulnerable pattern (socket reuse after close leading to double-pooling) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "impact_statement": "CVE-2022-25762 affects Apache Tomcat 9.0.0.M1 to 9.0.20. The target version 9.0.90 is well after the affected range. The vulnerability was fixed in upstream Apache Tomcat 9.0.21 (May 2019) through commits that introduced the CLOSED_NIO_CHANNEL pattern to prevent double-pooling of socket objects during concurrent WebSocket send/close operations. All fix commits (c2d6278b33, e2d5a040b9, 7046644bf3, 339b40bc07, 65fb1ee548) are present in the target and were authored by upstream Apache committers (remm@apache.org, markt@apache.org). The fixes were already in the upstream release when TuxCare onboarded version 9.0.90 in November 2025. The vulnerable pattern (socket reuse after close leading to double-pooling) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:42:00.511362+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2022-29885 is a documentation-only issue correcting misleading statements about EncryptInterceptor's security properties. The fix was already present in the upstream Apache Tomcat 9.0.90 release that TuxCare onboarded. All three affected documentation files (cluster-howto.xml, config/cluster.xml, security-howto.xml) have been updated to clarify that while EncryptInterceptor provides confidentiality and integrity protection, it does not protect against all risks associated with running on untrusted networks, particularly DoS attacks. This is not a code vulnerability - the EncryptInterceptor implementation was never vulnerable, only the documentation was misleading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "impact_statement": "CVE-2022-29885 is a documentation-only issue correcting misleading statements about EncryptInterceptor's security properties. The fix was already present in the upstream Apache Tomcat 9.0.90 release that TuxCare onboarded. All three affected documentation files (cluster-howto.xml, config/cluster.xml, security-howto.xml) have been updated to clarify that while EncryptInterceptor provides confidentiality and integrity protection, it does not protect against all risks associated with running on untrusted networks, particularly DoS attacks. This is not a code vulnerability - the EncryptInterceptor implementation was never vulnerable, only the documentation was misleading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.0-M15; >= 10.0.0-M1, < 10.0.21; >= 9.0.13, < 9.0.63; >= 8.5.38, < 8.5.79), NVD (>= 8.5.38, <= 8.5.78; >= 9.0.13, <= 9.0.62; >= 10.0.0, <= 10.0.20; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9), cve.org (>= 10.1.0-M1, <= 10.1.0-M14; = 10.1; >= 10.0.0-M1, <= 10.0.20; = 10; >= 9.0.13, <= 9.0.62; = 9; >= 8.5.38, <= 8.5.78; = 8.5), Snyk (>= 9.0.13, < 9.0.63)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "action_statement": "Vulnerability CVE-2022-34305 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 9.0.90. The upstream fix by Mark Thomas (commit 77c0ce2d169) was already included in the 9.0.90 release that TuxCare onboarded. The vulnerable pattern - multiple consecutive leading slashes in redirect URLs that could be exploited as protocol-relative redirects (e.g., \"//evil.com\") -...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 9.0.90. The upstream fix by Mark Thomas (commit 77c0ce2d169) was already included in the 9.0.90 release that TuxCare onboarded. The vulnerable pattern - multiple consecutive leading slashes in redirect URLs that could be exploited as protocol-relative redirects (e.g., \"//evil.com\") -..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 affects Apache Tomcat versions 9.0.0-M1 through 9.0.80 due to incomplete cleanup during recycling of internal objects. The target version 9.0.90 already contains the upstream fix (commit 44d05d75d6 by Mark Thomas from October 2023) that was shipped in the Apache Tomcat 9.0.81+ release. All vulnerable patterns have been addressed: part.delete(), session.endAccess(), asyncContext.r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 affects Apache Tomcat versions 9.0.0-M1 through 9.0.80 due to incomplete cleanup during recycling of internal objects. The target version 9.0.90 already contains the upstream fix (commit 44d05d75d6 by Mark Thomas from October 2023) that was shipped in the Apache Tomcat 9.0.81+ release. All vulnerable patterns have been addressed: part.delete(), session.endAccess(), asyncContext.r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T19:07:12.211534+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.90 is NOT AFFECTED by CVE-2023-45648. The vulnerable pattern (lack of trailer header validation) does not exist in this version. The upstream Apache Tomcat 9.0.90 release (May 2024) included an architectural refactoring that introduced HttpHeaderParser - a common header parser with built-in validation that prevents the vulnerability. The required defenses (rejecting non-token...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.90 is NOT AFFECTED by CVE-2023-45648. The vulnerable pattern (lack of trailer header validation) does not exist in this version. The upstream Apache Tomcat 9.0.90 release (May 2024) included an architectural refactoring that introduced HttpHeaderParser - a common header parser with built-in validation that prevents the vulnerability. The required defenses (rejecting non-token..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "action_statement": "Vulnerability CVE-2024-54677 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:28:57.615729+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.90 is NOT affected by CVE-2026-29129. The vulnerability was introduced when TLS 1.3 cipher suite configuration was added in later versions (commit 4ee45c5571), where a HashSet was incorrectly used to combine cipher suites, failing to preserve the configured preference order. The fix (commit 8d69b33764) changed HashSet to LinkedHashSet. Version 9.0.90 predates this feature ent...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.90 is NOT affected by CVE-2026-29129. The vulnerability was introduced when TLS 1.3 cipher suite configuration was added in later versions (commit 4ee45c5571), where a HashSet was incorrectly used to combine cipher suites, failing to preserve the configured preference order. The fix (commit 8d69b33764) changed HashSet to LinkedHashSet. Version 9.0.90 predates this feature ent..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 9.0.90-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-50229 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-50229"
      },
      "action_statement": "Vulnerability CVE-2026-50229 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:52:53.138657+00:00",
      "status_notes": "Vulnerability CVE-2026-53404 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-53404"
      },
      "action_statement": "Vulnerability CVE-2026-53404 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:48:00.070829+00:00",
      "status_notes": "Vulnerability CVE-2026-55276 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55276"
      },
      "action_statement": "Vulnerability CVE-2026-55276 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:42:00.050702+00:00",
      "status_notes": "Vulnerability CVE-2026-55955 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55955"
      },
      "action_statement": "Vulnerability CVE-2026-55955 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:25:24.528819+00:00",
      "status_notes": "Vulnerability CVE-2026-55956 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55956"
      },
      "action_statement": "Vulnerability CVE-2026-55956 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T16:31:00.070810+00:00",
      "status_notes": "Vulnerability CVE-2026-55957 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-55957"
      },
      "action_statement": "Vulnerability CVE-2026-55957 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat."
    }
  ]
}