{ "@id": "urn:uuid:c1f5d44d-6735-4feb-84b2-366e5b2c1fa6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:22:27.284985+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2008-1947 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2008-1947" }, "action_statement": "Vulnerability CVE-2008-1947 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2014-0095 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2014-0095" }, "action_statement": "Vulnerability CVE-2014-0095 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2017-12615 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2017-12615" }, "action_statement": "Vulnerability CVE-2017-12615 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12617" }, "impact_statement": "Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5648" }, "impact_statement": "CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2017-5651 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target is stock Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, authored by markt@apache.org). CVE-2017-5651 is the send-file-processing regression where a Processor could be added to the processor cache twice (fixed upstream in 8.5.13 / 9.0.0.M19 via BZ 60918). The affected range is 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18; 8.5.46 is well past that. Code inspection of java/org/apache/coyote/http11/Http11Processor.java confirms the full post-fix implementation is present and the pre-fix pattern is absent. The service loop declares SendfileState sendfileState = SendfileState.DONE (line 675), gates the keep-alive loop on sendfileState == SendfileState.DONE (line 678), calls sendfileState = processSendfile(socketWrapper) (line 867), and returns SocketState.SENDFILE exactly once when sendfileState == SendfileState.PENDING (lines 879-880). The method processSendfile(...) (lines 1678-1706) returns a SendfileState and only nulls sendfileData inside its own switch. The vulnerable pre-fix markers breakKeepAliveLoop() (boolean) and sendingWithSendfile are entirely absent (0 grep matches). The exact upstream patch commit 494429ca21 is in the target history and reachable from HEAD. This is an upstream/vendor fix already baked into the shipped version, not a TuxCare backport, so the vulnerable pattern is not present in HEAD => not_affected (code_not_present).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5651" }, "impact_statement": "Target is stock Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, authored by markt@apache.org). CVE-2017-5651 is the send-file-processing regression where a Processor could be added to the processor cache twice (fixed upstream in 8.5.13 / 9.0.0.M19 via BZ 60918). The affected range is 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18; 8.5.46 is well past that. Code inspection of java/org/apache/coyote/http11/Http11Processor.java confirms the full post-fix implementation is present and the pre-fix pattern is absent. The service loop declares SendfileState sendfileState = SendfileState.DONE (line 675), gates the keep-alive loop on sendfileState == SendfileState.DONE (line 678), calls sendfileState = processSendfile(socketWrapper) (line 867), and returns SocketState.SENDFILE exactly once when sendfileState == SendfileState.PENDING (lines 879-880). The method processSendfile(...) (lines 1678-1706) returns a SendfileState and only nulls sendfileData inside its own switch. The vulnerable pre-fix markers breakKeepAliveLoop() (boolean) and sendingWithSendfile are entirely absent (0 grep matches). The exact upstream patch commit 494429ca21 is in the target history and reachable from HEAD. This is an upstream/vendor fix already baked into the shipped version, not a TuxCare backport, so the vulnerable pattern is not present in HEAD => not_affected (code_not_present)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2018-11784 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2018-11784" }, "action_statement": "Vulnerability CVE-2018-11784 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2018-1304 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target is Apache Tomcat 8.5.46 (HEAD tag confirmed, SHA 914f68b4). CVE-2018-1304: a security constraint whose URL pattern is the empty string \"\" (which maps to the context root) was ignored in RealmBase.findSecurityConstraints, letting unauthorised users reach the protected context root. The upstream fix (bug 62067) makes two changes in java/org/apache/catalina/realm/RealmBase.java: (1) normalise an empty/null request URI to \"/\", and (2) treat an empty-string pattern as matching the context-root URI \"/\". The target already contains BOTH changes verbatim \u2014 line 557 `if (uri == null || uri.length() == 0) { uri = \"/\"; }` and line 590 `if(uri.equals(patterns[k]) || patterns[k].length() == 0 && uri.equals(\"/\"))` with the comment \"Exact match including special case for the context root.\" git blame attributes both lines to upstream commit 5af7c13cff7 (Mark Thomas , 2018-02-06, the 8.5.x branch fix listed in the patch set). The commit is an ancestor of HEAD and was shipped in the upstream 8.5.46 release \u2014 not a TuxCare backport. Verdict: not_affected (upstream vendor fix already present; justification code_not_present).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1304" }, "impact_statement": "Target is Apache Tomcat 8.5.46 (HEAD tag confirmed, SHA 914f68b4). CVE-2018-1304: a security constraint whose URL pattern is the empty string \"\" (which maps to the context root) was ignored in RealmBase.findSecurityConstraints, letting unauthorised users reach the protected context root. The upstream fix (bug 62067) makes two changes in java/org/apache/catalina/realm/RealmBase.java: (1) normalise an empty/null request URI to \"/\", and (2) treat an empty-string pattern as matching the context-root URI \"/\". The target already contains BOTH changes verbatim \u2014 line 557 `if (uri == null || uri.length() == 0) { uri = \"/\"; }` and line 590 `if(uri.equals(patterns[k]) || patterns[k].length() == 0 && uri.equals(\"/\"))` with the comment \"Exact match including special case for the context root.\" git blame attributes both lines to upstream commit 5af7c13cff7 (Mark Thomas , 2018-02-06, the 8.5.x branch fix listed in the patch set). The commit is an ancestor of HEAD and was shipped in the upstream 8.5.46 release \u2014 not a TuxCare backport. Verdict: not_affected (upstream vendor fix already present; justification code_not_present)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2018-1305 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target is Apache Tomcat at tag 8.5.46 (HEAD 914f68b451). CVE-2018-1305 affected 8.5.0\u20138.5.27 and was fixed upstream in 8.5.28 by commit 2349801827 (Mark Thomas, markt@apache.org): \"Process all ServletSecurity annotations at web application start rather than at servlet load time to ensure constraints are applied consistently.\" That commit is an ancestor of HEAD and the full post-fix state is present in the target. The vulnerable lazy-registration pattern is absent, so the target is not affected. The fix is upstream-authored (apache.org domain, not TuxCare/CloudLinux), so the verdict is not_affected (vendor-fix branch) with justification code_not_present, rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1305" }, "impact_statement": "Target is Apache Tomcat at tag 8.5.46 (HEAD 914f68b451). CVE-2018-1305 affected 8.5.0\u20138.5.27 and was fixed upstream in 8.5.28 by commit 2349801827 (Mark Thomas, markt@apache.org): \"Process all ServletSecurity annotations at web application start rather than at servlet load time to ensure constraints are applied consistently.\" That commit is an ancestor of HEAD and the full post-fix state is present in the target. The vulnerable lazy-registration pattern is absent, so the target is not affected. The fix is upstream-authored (apache.org domain, not TuxCare/CloudLinux), so the verdict is not_affected (vendor-fix branch) with justification code_not_present, rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2018-1336 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target version 8.5.46 is not affected by CVE-2018-1336. The vulnerability affected Apache Tomcat versions 8.5.0 to 8.5.30. The upstream vendor fix (commit e00812b94e, authored by Mark Thomas markt@apache.org on 2018-04-27) was first included in version 8.5.31. The target version 8.5.46 inherits this fix from upstream, with the vulnerable pattern (missing input position rewind on UTF-8 decoder overflow) already removed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1336" }, "impact_statement": "Target version 8.5.46 is not affected by CVE-2018-1336. The vulnerability affected Apache Tomcat versions 8.5.0 to 8.5.30. The upstream vendor fix (commit e00812b94e, authored by Mark Thomas markt@apache.org on 2018-04-27) was first included in version 8.5.31. The target version 8.5.46 inherits this fix from upstream, with the vulnerable pattern (missing input position rewind on UTF-8 decoder overflow) already removed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2018-8014 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.46 is not affected by CVE-2018-8014. The upstream vendor (Apache) fixed this vulnerability on 2018-05-16 (commit 60f596a21f), over a year before the 8.5.46 release (2019-09-16). All three components of the fix are present: DEFAULT_ALLOWED_ORIGINS changed from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS changed from \"true\" to \"false\", and runtime validation preventing the insecure combination.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8014" }, "impact_statement": "Apache Tomcat 8.5.46 is not affected by CVE-2018-8014. The upstream vendor (Apache) fixed this vulnerability on 2018-05-16 (commit 60f596a21f), over a year before the 8.5.46 release (2019-09-16). All three components of the fix are present: DEFAULT_ALLOWED_ORIGINS changed from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS changed from \"true\" to \"false\", and runtime validation preventing the insecure combination." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2018-8034 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Apache Tomcat 8.5.46 is NOT affected by CVE-2018-8034. The upstream vendor (Apache Tomcat) fixed this vulnerability in version 8.5.32 (first version after the affected range 8.5.0-8.5.31). The fix is present in the target code at WsWebSocketContainer.java:939-945, where setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification for TLS WebSocket connections. This is an upstream vendor fix authored by Mark Thomas from Apache, not a TuxCare backport. The vulnerable pattern (missing hostname verification) is not present in version 8.5.46.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8034" }, "impact_statement": "Apache Tomcat 8.5.46 is NOT affected by CVE-2018-8034. The upstream vendor (Apache Tomcat) fixed this vulnerability in version 8.5.32 (first version after the affected range 8.5.0-8.5.31). The fix is present in the target code at WsWebSocketContainer.java:939-945, where setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification for TLS WebSocket connections. This is an upstream vendor fix authored by Mark Thomas from Apache, not a TuxCare backport. The vulnerable pattern (missing hostname verification) is not present in version 8.5.46." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2018-8037 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2018-8037" }, "action_statement": "Vulnerability CVE-2018-8037 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-0232 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-0232" }, "action_statement": "Vulnerability CVE-2019-0232 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2019-10072 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-10072" }, "action_statement": "Vulnerability CVE-2019-10072 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2019-12418 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-12418" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2019-17563 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-17563" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2019-17569 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2019-17569" }, "action_statement": "Vulnerability CVE-2019-17569 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-2684" }, "impact_statement": "not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2020-1938 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-1938" }, "action_statement": "Vulnerability CVE-2020-1938 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2020-9484" }, "action_statement": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2021-24122 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-24122" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2021-25329 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2021-25329" }, "action_statement": "Vulnerability CVE-2021-25329 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2022-42252 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42252" }, "impact_statement": "Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T21:11:34.688190+00:00", "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-24998" }, "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T01:46:20.750358+00:00", "status_notes": "Vulnerability CVE-2023-28709 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-28709" }, "action_statement": "Vulnerability CVE-2023-28709 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2023-34981 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-34981" }, "action_statement": "Vulnerability CVE-2023-34981 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-41080" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-42795" }, "action_statement": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-45648" }, "action_statement": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2023-46589" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-24549" }, "action_statement": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-50379" }, "action_statement": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2024-52317 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-52317" }, "action_statement": "Vulnerability CVE-2024-52317 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-24813" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2025-31650 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31650" }, "impact_statement": "Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-46701" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48988" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-48989" }, "action_statement": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-49125" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-52520" }, "action_statement": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55668" }, "action_statement": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55752" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-24880" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:06:38.524754+00:00", "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-25854" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-32990 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32990" }, "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-22T11:04:45.401942+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.46-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat.embed:tomcat-embed-core 8.5.46-tuxcare.1.", "vulnerability": { "name": "GHSA-r53m-pfr5-7v87" }, "impact_statement": "The vulnerability has been withdrawn." } ] }