{ "@id": "urn:uuid:cb105ced-922b-4fad-9f88-80a4b4d9961b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 38, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T15:44:00.110412+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-5018 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2016-5018 affects Apache Tomcat 7.0.0-7.0.70", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5018" }, "impact_statement": "CVE-2016-5018 affects Apache Tomcat 7.0.0-7.0.70" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2017-12615 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2017-12615" }, "action_statement": "Vulnerability CVE-2017-12615 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-12617 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. already_fixed \u2014 Apache Tomcat 7.0.109 is outside the affected range for CVE-2017-12617 (7.0.0\u20137.0.81). The vulnerability was fixed upstream in 7.0.82, with a follow-up correction in 7.0.89, so 7.0.109 carries the complete fix. The affected components \u2014 FileDirContext, VirtualDirContext, JrePlatform and DefaultServlet \u2014 are byte-identical to the corresponding files in the upstream Apache Tomcat 7.0.109 release, and the upstream regression tests for this CVE are present and unmodified.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-12617" }, "impact_statement": "already_fixed \u2014 Apache Tomcat 7.0.109 is outside the affected range for CVE-2017-12617 (7.0.0\u20137.0.81). The vulnerability was fixed upstream in 7.0.82, with a follow-up correction in 7.0.89, so 7.0.109 carries the complete fix. The affected components \u2014 FileDirContext, VirtualDirContext, JrePlatform and DefaultServlet \u2014 are byte-identical to the corresponding files in the upstream Apache Tomcat 7.0.109 release, and the upstream regression tests for this CVE are present and unmodified." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2017-5648 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2017-5648 affects Apache Tomcat 7.0.0-7.0.75", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5648" }, "impact_statement": "CVE-2017-5648 affects Apache Tomcat 7.0.0-7.0.75" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-11784 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2018-11784" }, "action_statement": "Vulnerability CVE-2018-11784 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-1304 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. not_affected \u2014 CVE-2018-1304 affects Apache Tomcat 7.0.0 to 7.0.84. The target repository is Tomcat 7.0.109, which already includes the upstream vendor fix (commit 2d69fde135 by Mark Thomas from Apache, applied in version 7.0.85). Both required defenses are present in RealmBase.java: (1) empty string URI normalization to \"/\" at line 702, and (2) explicit pattern matching for empty string patterns with context...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1304" }, "impact_statement": "not_affected \u2014 CVE-2018-1304 affects Apache Tomcat 7.0.0 to 7.0.84. The target repository is Tomcat 7.0.109, which already includes the upstream vendor fix (commit 2d69fde135 by Mark Thomas from Apache, applied in version 7.0.85). Both required defenses are present in RealmBase.java: (1) empty string URI normalization to \"/\" at line 702, and (2) explicit pattern matching for empty string patterns with context..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-1305 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) is NOT vulnerable to CVE-2018-1305. The vulnerability affected versions 7.0.0 to 7.0.84, and was fixed in 7.0.85. The target version includes the complete fix: ServletSecurity annotations are processed at application startup rather than lazily at servlet load time, eliminating the timing-dependent security constraint application issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1305" }, "impact_statement": "Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) is NOT vulnerable to CVE-2018-1305. The vulnerability affected versions 7.0.0 to 7.0.84, and was fixed in 7.0.85. The target version includes the complete fix: ServletSecurity annotations are processed at application startup rather than lazily at servlet load time, eliminating the timing-dependent security constraint application issue." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-1336 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. Patches already applied: e00812b94e5830b2be3de04f4ae4ade38a700074 (already in target via 156d76a6af 'Improve handing of overflow in the UTF-8 decoder with supplementary characters.')", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1336" }, "impact_statement": "Patches already applied: e00812b94e5830b2be3de04f4ae4ade38a700074 (already in target via 156d76a6af 'Improve handing of overflow in the UTF-8 decoder with supplementary characters.')" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-8014 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. already_fixed \u2014 CVE-2018-8014 fix is already present in the target repository. The target (Tomcat 7.0.109-tuxcare.1) contains commit 5877390a96 which addresses the insecure CORS filter defaults. All three critical security changes from the vendor patch are present: (1) DEFAULT_ALLOWED_ORIGINS changed to empty string, (2) DEFAULT_SUPPORTS_CREDENTIALS changed to false, and (3) validation logic added to prevent t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8014" }, "impact_statement": "already_fixed \u2014 CVE-2018-8014 fix is already present in the target repository. The target (Tomcat 7.0.109-tuxcare.1) contains commit 5877390a96 which addresses the insecure CORS filter defaults. All three critical security changes from the vendor patch are present: (1) DEFAULT_ALLOWED_ORIGINS changed to empty string, (2) DEFAULT_SUPPORTS_CREDENTIALS changed to false, and (3) validation logic added to prevent t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-8034 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2018-8034 (missing hostname verification for WebSocket TLS connections) is NOT present in Apache Tomcat 7.0.109-tuxcare.4. The upstream Apache vendor already fixed this vulnerability in commit 2c52279516 (June 18, 2018) by enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\") in the SSLEngine configuration. This fix was included in the upstream 7.0.109 release (April 22, 2021), and the TuxCare-maintained version inherited this already-fixed state when the 7.0.109 baseline was onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8034" }, "impact_statement": "CVE-2018-8034 (missing hostname verification for WebSocket TLS connections) is NOT present in Apache Tomcat 7.0.109-tuxcare.4. The upstream Apache vendor already fixed this vulnerability in commit 2c52279516 (June 18, 2018) by enabling hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\") in the SSLEngine configuration. This fix was included in the upstream 7.0.109 release (April 22, 2021), and the TuxCare-maintained version inherited this already-fixed state when the 7.0.109 baseline was onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2018-8037 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2018-8037" }, "action_statement": "Vulnerability CVE-2018-8037 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0232 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2019-0232" }, "action_statement": "Vulnerability CVE-2019-0232 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2019-10072 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2019-10072" }, "action_statement": "Vulnerability CVE-2019-10072 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-12418 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. already_fixed \u2014 CVE-2019-12418 has been fixed in this Tomcat 7.0.109-tuxcare.1 repository. The security fix from commit bef3f40400 (November 14, 2019) is present. The vulnerable standard RMI registry that allowed bind/unbind/rebind operations has been replaced with a custom immutable JmxRegistry class that prevents registry manipulation attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12418" }, "impact_statement": "already_fixed \u2014 CVE-2019-12418 has been fixed in this Tomcat 7.0.109-tuxcare.1 repository. The security fix from commit bef3f40400 (November 14, 2019) is present. The vulnerable standard RMI registry that allowed bind/unbind/rebind operations has been replaced with a custom immutable JmxRegistry class that prevents registry manipulation attacks." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-17563 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2019-17563" }, "action_statement": "Vulnerability CVE-2019-17563 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2020-1938 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2020-1938" }, "action_statement": "Vulnerability CVE-2020-1938 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2020-9484 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. Tomcat 7.0.109 is not vulnerable as it is higher than upstream fix version - 7.0.108", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9484" }, "impact_statement": "Tomcat 7.0.109 is not vulnerable as it is higher than upstream fix version - 7.0.108" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-24122 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2021-24122 affects Apache Tomcat 7.0.0-7.0.106", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-24122" }, "impact_statement": "CVE-2021-24122 affects Apache Tomcat 7.0.0-7.0.106" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2021-25329 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2021-25329" }, "action_statement": "Vulnerability CVE-2021-25329 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T21:12:12.887949+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-22T14:27:21.818338+00:00", "status_notes": "Vulnerability CVE-2022-45143 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 7.0.109-tuxcare.5.", "vulnerability": { "name": "CVE-2022-45143" }, "action_statement": "Vulnerability CVE-2022-45143 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 7.0.109-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T21:11:34.688190+00:00", "status_notes": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2023-24998" }, "action_statement": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T21:07:35.663971+00:00", "status_notes": "Vulnerability CVE-2023-41080 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2023-41080" }, "action_statement": "Vulnerability CVE-2023-41080 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2023-42795" }, "action_statement": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2023-45648" }, "action_statement": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24549 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2024-24549" }, "action_statement": "Vulnerability CVE-2024-24549 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38286 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2024-38286" }, "action_statement": "Vulnerability CVE-2024-38286 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2024-50379 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2024-50379" }, "action_statement": "Vulnerability CVE-2024-50379 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-24813 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-24813" }, "action_statement": "Vulnerability CVE-2025-24813 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31650 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-31650" }, "action_statement": "Vulnerability CVE-2025-31650 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-27T21:00:35.277593+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 7.0.109-tuxcare.6.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 7.0.109-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-46701 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-46701" }, "action_statement": "Vulnerability CVE-2025-46701 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-48988" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2025-48989 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-48989" }, "action_statement": "Vulnerability CVE-2025-48989 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49125 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. Version 7.0.109 is not vulnerable. Summary: CVE-2025-49125 does not affect this Tomcat instance. The target is running Tomcat 7.0.109, which predates the introduction of the vulnerable PreResources/PostResources features. These features were introduced in Tomcat 8.0 as part of the WebResourceRoot API. The CVE explicitly lists only Tomcat 9.x, 10.x, and 11.x as affected versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49125" }, "impact_statement": "Version 7.0.109 is not vulnerable. Summary: CVE-2025-49125 does not affect this Tomcat instance. The target is running Tomcat 7.0.109, which predates the introduction of the vulnerable PreResources/PostResources features. These features were introduced in Tomcat 8.0 as part of the WebResourceRoot API. The CVE explicitly lists only Tomcat 9.x, 10.x, and 11.x as affected versions." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-52434 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-52434" }, "action_statement": "Vulnerability CVE-2025-52434 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-52520 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-52520" }, "action_statement": "Vulnerability CVE-2025-52520 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-53506 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-53506" }, "action_statement": "Vulnerability CVE-2025-53506 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T20:42:04.886450+00:00", "status_notes": "Vulnerability CVE-2025-55668 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. not_affected \u2014 CVE-2025-55668 is a session fixation vulnerability in Apache Tomcat's RewriteValve component, which processes redirects without properly encoding session IDs. However, Tomcat 7.0.109 does not contain the RewriteValve component at all. RewriteValve was introduced in Tomcat 8.0 (January 2013) and never existed in the Tomcat 7 branch. Exhaustive searches of the codebase, directory structure, and g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55668" }, "impact_statement": "not_affected \u2014 CVE-2025-55668 is a session fixation vulnerability in Apache Tomcat's RewriteValve component, which processes redirects without properly encoding session IDs. However, Tomcat 7.0.109 does not contain the RewriteValve component at all. RewriteValve was introduced in Tomcat 8.0 (January 2013) and never existed in the Tomcat 7 branch. Exhaustive searches of the codebase, directory structure, and g..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-55752" }, "action_statement": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-61795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-61795" }, "action_statement": "Vulnerability CVE-2025-61795 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-30T10:58:34.392596+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-24880" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T20:01:16.621327+00:00", "status_notes": "Vulnerability CVE-2026-25854 does not affect version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper. not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25854" }, "impact_statement": "not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-10-28T18:10:34.135169+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@7.0.109-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.3 of org.apache.tomcat.embed:tomcat-embed-jasper." } ] }